# changelog

author: daifan <daifan@uniontech.com> - 4.19.0-91.141.1
changelog:
  - UOS: updated the openeuler_defconfig && openeuler_debug_defconfig
  - (CVE-2023-1078)rds: rds_rm_zerocopy_callback() use list_first_entry()
  - (CVE-2023-26545)net: mpls: fix stale pointer if allocation fails during device rename


author: daifan <daifan@uniontech.com> - 4.19.0-91.141.2
changelog:
  - irqchip/loongarch-extioi: Improve affinity setting
  - scsi: lpfc: Add the FLOGI cmd to the list of commands which are allowed to retry
  - (CVE-2023-1513)kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - UOS: fix loongarch warning


author: daifan <daifan@uniontech.com> - 4.19.0-91.141.3
changelog:
  - (CVE-2023-30772)power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - (CVE-2023-1989)Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
  - (CVE-2023-1990)nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - (CVE-2023-1829)net/sched: Retire tcindex classifier


author: daifan <daifan@uniontech.com> - 4.19.0-91.141.4
changelog:
  - (CVE-2023-2248)net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  - (CVE-2023-2194)i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()


author: daifan <daifan@uniontech.com> - 4.19.0-91.141.5
changelog:
  - UOS: loongarch/config: enable CONFIG_CRASH_DUMP
  - UOS: loongarch/config: enable CONFIG_PARAVIRT
  - fbdev: ls2k500 sfb add module device table to enable module auto load.
  - fbdev: ls2k500 sfb add set par to support resolution setup.
  - Adds parsing compatibility for screen info guid.
  - fbdev: ls2k500sfb gpio irq handler stop all cpus to wait pcie training done.
  - LoongArch:LSVZ: implement the paravirt qspinlock call
  - drm/loongson: do not load loongson drm driver if ls2k500 bmc been found.
  - pci/quirk.c: Add limit for mrrs of 7A2000
  - Revert "LoongArch: Not using GCC stackrealign feature"
  - net: mucse: Update Mucse's network card device driver
  - LoongArch: nokaslr added to builtin cmdline
  - Revert "LoongArch: use generic irq migration"
  - LoongArch: Enable KASLR
  - LoongArch: Add the same binary implementation of kdump
  - irqchip/loongarch: Improve extioi code for guest cpu
  - LoongArch: Fix cpuhotplug on master core
  - xhci: Fix usb device probability miss
  - loongarch/kvm: ls7a add iocsrw emulation
  - fbdev: ls2k500 sfb add gpio request fail process.
  - LoongArch: kdump: Reimplement crashkernel=YM
  - LoongArch: Backport upstream kexec/kdump feature
  - LoongArch: export symbol invalid_pud_table
  - LoongArch: fix pm callback function error
  - LoongArch: Fix enable_gpe_wakeup() function error
  - irqchip: irq-loongson-liointc: fix some registers not be saved during S3
  - LoongArch: Make spinlock_test not dependent on Debug_FS
  - Revert "LoongArch: Introduce optimize syscall for loongarch"
  - Revert "LoongArch:fixed some error fo loongson_syscall"
  - Revert "LoongArch:Fix the bug of ls_dup copying invalid file descriptors"
  - LoongArch:LSVZ: KVM adds compatibility code for 5.10
  - LoongArch:LSVZ: KVM adds compatibility code for 4.19 and 5.4.
  - LoongArch:LSVZ: move csr read and write function as internal
  - LoongArch:LSVZ: move IOCSR maro definition as internal
  - LoongArch: Fix elf hwcap
  - LoongArch:Fix the bug of ls_dup copying invalid file descriptors
  - LoongArch:fixed some error fo loongson_syscall
  - LoongArch: Introduce optimize syscall for loongarch
  - LoongArch: a0 and a1 instead of v0 and v1
  - LoongArch: Clean up _save_lsx_all_upper
  - LoongArch: Combine acpi_boot_table_init() and acpi_boot_init()
  - LoongArch: Improve thread_xxxx_context_live
  - ipmi: ls2k500 bmc readd btlock.
  - LoongArch: Use correct sp value to get graph addr in unwinder guess/prologue
  - LoongArch: Fix a deadlock in context_switch()
  - LoongArch: Add memset operation to screen_info
  - LoongArch: Fix initrd parsing in the small fdt method
  - LS7A2000: GNET: fix device register error when depend different domain_nr
  - LoongArch: Not using GCC stackrealign feature
  - LoongArch: Fix the initrd parsing on the command line
  - LoongArch: Efistub support V40 interface
  - drm/loongson: Improve 7A2000 VGA hot plug detection process.
  - LoongArch: Refactoring emulate_load_store_insn
  - LoongArch: Fix kexec operation failed to resolve initrd on V4.0 interface
  - LoongArch: Use flexible-array member instead of zero-length array
  - LoongArch: Improve power manager
  - LoongArch: Remove unused kernel stack padding
  - LoongArch: Remove the rest of unused kernel stack padding
  - drm/loongson: Fix connector detect error in bridge phy.
  - LoongArch: Delete unnecessary page alignment.
  - objtool: LoongArch: Fix dynamic_add_jump_table() on gcc-vec.33
  - LoongArch: Improve alt_instr
  - fbdev: ls2k500 sfb add gpio interrupt notification process when ls2k500 watchdog bite.
  - Revert "LoongArch: Add the kexec/kdump operation under the new firmware"
  - loongarch_iommu: enable the loongarch iommu by default.
  - LoongArch: Fixup vmemmap bootup error
  - ALSA: HDA: Fixup hda driver for loongson HDA
  - LoongArch:Add backlight restore support
  - LoongArch: Improve perf events
  - LoongArch:LSVZ: move kvm related head file as internal
  - scsi: sr: get rid of sr global mutex
  - drm/loongson: Improve bridge phy bind process.
  - LoongArch: Support initrd passing by systemtable
  - LoongArch:LSVZ: use former Kconfig format with kvm
  - loongarch: remove gtlb instruction
  - LoongArch:LSVZ: move CSR maro definition as internal
  - fbdev: ls2k500 sfb add interrupt process for bmc reboot.
  - drm/loongson: Support 4K@30Hz resolution in loongson.
  - LoongArch: syscall_common: check if syscall number a7 less then zero
  - LoongArch: Change the operation of the ACPI PM register
  - LoongArch:Adjust resume order for loongson_hkey_resume
  - LoongArch: Improve /dev/mem related interfaces
  - LoongArch: mm: Refactor TLB handlers
  - Loongarch:Adjust the grouping method of extioi->node_map
  - LoongArch: Remove relocate exception table
  - LoongArch: Remove some .fixup usage
  - LoongArch: extable: Add a dedicated uaccess handler
  - LoongArch: Add gpr-num.h
  - LoongArch: extable: Add `type` and `data` fields
  - LoongArch: extable: switch to relative exception tables
  - LoongArch: extable: consolidate __ex_table construction
  - LoongArch: kexec: Use IOCSR method in kexec_smp_wait
  - LoongArch: Flush TLB earlier at initialization
  - LoongArch:LSVZ: remove using eentry global variable
  - LoongArch: Fixup do_ri instruction emulation
  - (CVE-2023-32233)netfilter: nf_tables: deactivate anonymous set from preparation phase
  - (CVE-2023-32269)netrom: Fix use-after-free caused by accept on already connected socket
  - (CVE-2023-2002)bluetooth: Perform careful capability checks in hci_sock_ioctl()


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.16
changelog:
  - uos: fix kabi by -
  - uos: enable CONFIG_DRM_PHYTIUM=m
  - stable: {CVE-2023-5717} perf: Disallow mis-matched inherited group reads [T297505]
  - uos: fix kabi changed with cpu_info
  - uos: Fix the zhaoxin compilation error by c43be4782938 and c87911c9ae0c
  - uos: fix compile error [T302429]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.17
changelog:
  - uos: Revert "UOS: Compile st_gmac and IGB network card drivers to kernel modules"
  - uos: loongarch: Open tcm_fc configuration
  - uos: fix kabi by f5d961e43bbc


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.19
changelog:
  - uos: add feature1 [T302819]
  - uos: stream performance optimization
  - stable: {CVE-2023-45863} kobject: Fix slab-out-of-bounds in fill_kobj_path() [T297509]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.22
changelog:
  * Thu Nov 30 2023 daifan <daifan@uniontech.com> - 4.19.0-91.152.21
  - uos: Fix the patch of coherent DMA writes disorder issue for Zhaoxin KH-40000
  - uos: dup: rename config and cmdline
  - uos: Modify the default configuration file to uos419_defconfig
  - uos: rename config's name to uos
  - uos: zhaoxin: Add support for Zhaoxin Processors
  - uos: feature1: fix params passed error in uld_copy_bitmap()
  - uos: feature1: fix full_fds init error
  - uos: feature1: fix fdt changed after get_unused_fd()
  - uos: feature1: fix __get_file NULL pointer dereference


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.23
changelog:
  - uos: fix kabi breakup by merging cve patch [T310775]
  - stable: {CVE-2023-51780} atm: Fix Use-After-Free in do_vcc_ioctl [T310775]
  - stable: {CVE-2023-51781} appletalk: Fix Use-After-Free in atalk_ioctl [T310775]
  - stable: {CVE-2023-51782} net/rose: Fix Use-After-Free in rose_ioctl [T310775]
  - stable: {CVE-2023-6931} perf: Fix perf_event_validate_size() [T310775]
  - stable: {CVE-2023-6931} perf/core: Add a new read format to get a number of lost samples [T310775]
  - stable: {CVE-2023-6932} ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet [T310775]
  - euler: netfilter: nf_queue: fix socket leak
  - uos: bugfix: fixup marvell sata controller init fail on some machine
  - Merge "stable: iommu/vt-d: Leave scalable mode default off [T285937]" into 1060a-152-lts
  - uos: lms feature optimized
  - stable: iommu/vt-d: Leave scalable mode default off [T285937]
  - uos: uos lms feature
  - uos: Revert "uos: stream performance optimization"


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.24
changelog:
  - uos: igb: add architecture flag for loongarch patch [B237615]
  - uos: Revert "uos: bugfix: fixup marvell sata controller init fail on some machine" [B240939]
  - stable: {CVE-2023-7192} netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() [T310775]
  - stable: {CVE-2023-6606} smb: client: fix OOB in smbCalcSize() [T310775]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.25
changelog:
  - uos: Fix the issue of crashing during reboot. Release reserved memory resources
  - uos: elfverify: fix slab memory leak [T325833]
  - stable: {CVE-2023-46838} xen-netback: don't produce zero-size SKB frags [T310775]
  - stable: {CVE-2023-6040} netfilter: nf_tables: Reject tables of unsupported family [T310775]
  - stable: {CVE-2023-46343} nfc: nci: fix possible NULL pointer dereference in send_acknowledge() [T310775]
  - stable: {CVE-2023-51042} drm/amdgpu: Fix potential fence use-after-free v2 [T310775]
  - stable: {CVE-2023-51043} drm/atomic: Fix potential use-after-free in nonblocking commits [T310775]
  - stable: {CVE-2024-0775} ext4: improve error recovery code paths in __ext4_remount() [T310775]
  - euler: {CVE-2021-33631} ext4: fix kernel BUG in 'ext4_write_inline_data_end()' [T310775]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.26
changelog:
  - Merge "uos: bugfix: fixup marvell sata controller init fail on some machine" into 1060a-152-lts
  - uos: bugfix: fixup marvell sata controller init fail on some machine
  - stable: {CVE-2024-23849} net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv [T310775]
  - stable: {CVE-2024-1086} netfilter: nf_tables: reject QUEUE/DROP verdict parameters [T310775]
  - stable: {CVE-2024-0607} netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() [T310775]
  - stable: {CVE-2024-0340} vhost: use kzalloc() instead of kmalloc() followed by memset() [T310775]
  - stable: {CVE-2024-26597} net: qualcomm: rmnet: fix global oob in rmnet_policy [T310775]
  - stable: {CVE-2023-52464} EDAC/thunderx: Fix possible out-of-bounds string access [T310775]
  - stable: {CVE-2023-52451} powerpc/pseries/memhp: Fix access beyond end of drmem array [T310775]
  - stable: {CVE-2023-52451} powerpc/pseries/memhotplug: Quieten some DLPAR operations [T310775]
  - stable: {CVE-2023-52449} mtd: Fix gluebi NULL pointer dereference caused by ftl notifier [T310775]
  - stable: {CVE-2023-52445} media: pvrusb2: fix use after free on context disconnection [T310775]
  - stable: {CVE-2023-52444} f2fs: fix to avoid dirent corruption [T310775]
  - stable: {CVE-2023-52443} apparmor: avoid crash when parsed profile name is empty [T310775]
  - stable: {CVE-2023-52439} uio: Fix use-after-free in uio_open [T310775]
  - stable: {CVE-2023-52436} f2fs: explicitly null-terminate the xattr list [T310775]


author: caina <caina@uniontech.com> - 4.19.0-91.152.27
changelog:
  - stable: {CVE-2023-7042} wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() [T334689]
  - stable: {CVE-2024-22099} Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security [T334689]
  - stable: {CVE-2023-6270} aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts [T334689]
  - stable: kvm/arm64: fixed passthrough gpu into vm on arm64


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.28
changelog:
  - euler: net: sctp: update stream->incnt after successful allocation of stream_in [B342737]
  - uos: export uld_fcheck_file symbol [B251417]
  - uos: fix kabi break [T334689]
  - stable: {CVE-2024-26793} gtp: fix use-after-free and null-ptr-deref in gtp_newlink() [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix potential bug in end_buffer_async_write [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix buffer corruption due to concurrent device reads [T334689]
  - stable: {CVE-2023-52340} ipv6: remove max_size check inline with ipv4 [T334689]
  - stable: {CVE-2023-52340} ipv6: make ip6_rt_gc_expire an atomic_t [T334689]
  - stable: {CVE-2023-52340} net/dst: use a smaller percpu_counter batch for dst entries accounting [T334689]
  - stable: {CVE-2023-52340} net: add a route cache full diagnostic message [T334689]
  - stable: {CVE-2024-26636} llc: make llc_ui_sendmsg() more robust against bonding changes [T334689]
  - stable: {CVE-2024-26645} tracing: Ensure visibility when inserting an element into tracing_map [T334689]
  - stable: {CVE-2024-26651} sr9800: Add check for usbnet_get_endpoints [T334689]
  - stable: {CVE-2024-26663} tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() [T334689]
  - stable: {CVE-2024-26664} hwmon: (coretemp) Fix out-of-bounds memory access [T334689]
  - stable: {CVE-2024-26671} blk-mq: fix IO hang from sbitmap wakeup race [T334689]
  - stable: {CVE-2024-26675} ppp_async: limit MRU to 64K [T334689]
  - stable: {CVE-2024-26679} inet: read sk->sk_family once in inet_recv_error() [T334689]
  - stable: {CVE-2024-26696} nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() [T334689]
  - stable: {CVE-2024-26697} nilfs2: fix data corruption in dsync block recovery for small block sizes [T334689]
  - stable: {CVE-2024-26704} ext4: fix double-free of blocks due to wrong extents moved_len [T334689]
  - stable: {CVE-2024-26720} mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again [T334689]
  - stable: {CVE-2024-26735} ipv6: sr: fix possible use-after-free and null-ptr-deref [T334689]
  - stable: {CVE-2024-26744} RDMA/srpt: Support specifying the srpt_service_guid parameter [T334689]
  - stable: {CVE-2024-26751} ARM: ep93xx: Add terminator to gpiod_lookup_table [T334689]
  - stable: {CVE-2024-26752} l2tp: pass correct message length to ip6_append_data [T334689]
  - stable: {CVE-2024-26754} gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() [T334689]
  - stable: {CVE-2024-26763} dm-crypt: don't modify the data when using authenticated encryption [T334689]
  - stable: {CVE-2024-26764} fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one error [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors [T334689]
  - stable: {CVE-2024-26772} ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() [T334689]
  - stable: {CVE-2024-26773} ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() [T334689]
  - stable: {CVE-2024-26777} fbdev: sis: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26778} fbdev: savage: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26779} wifi: mac80211: fix race condition on enabling fast-xmit [T334689]
  - stable: {CVE-2024-26791} btrfs: dev-replace: properly validate device names [T334689]
  - stable: {CVE-2024-26801} Bluetooth: Avoid potential use-after-free in hci_error_reset [T334689]
  - stable: {CVE-2024-26805} netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter [T334689]
  - stable: {CVE-2024-26600} phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP [T334689]
  - stable: {CVE-2024-26606} binder: signal epoll threads of self-work [T334689]
  - stable: {CVE-2024-26615} net/smc: fix illegal rmb_desc access in SMC-D connection dump [T334689]
  - stable: {CVE-2024-26625} llc: call sock_orphan() at release time [T334689]
  - stable: {CVE-2024-26633} ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() [T334689]
  - stable: {CVE-2024-26635} llc: Drop support for ETH_P_TR_802_2. [T334689]
  - stable: {CVE-2023-52583} ceph: fix deadlock or deadcode of misusing dget() [T334689]
  - stable: {CVE-2023-52603} UBSAN: array-index-out-of-bounds in dtSplitRoot [T334689]
  - stable: {CVE-2023-52604} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52606} powerpc/lib: Validate size for vector operations [T334689]
  - stable: {CVE-2023-52607} powerpc/mm: Fix null-pointer dereference in pgtable_cache_add [T334689]
  - stable: {CVE-2023-52609} binder: fix race between mmput() and do_exit() [T334689]
  - stable: {CVE-2023-52612} crypto: scomp - fix req->dst buffer overflow [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - Use per-CPU struct instead multiple variables [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - return proper error code for allocation failure [T334689]
  - stable: {CVE-2023-52615} hwrng: core - Fix page fault dead lock on mmap-ed hwrng [T334689]
  - stable: {CVE-2023-52619} pstore/ram: Fix crash when setting number of cpus to an odd number [T334689]
  - stable: {CVE-2023-52622} ext4: avoid online resizing failures due to oversized flex bg [T334689]
  - stable: {CVE-2023-52622} ext4: unify the type of flexbg_size to unsigned int [T334689]
  - stable: {CVE-2023-52622} ext4: remove unnecessary check from alloc_flex_gd() [T334689]
  - stable: {CVE-2023-52623} SUNRPC: Fix a suspicious RCU usage warning [T334689]
  - stable: {CVE-2023-52469} drivers/amd/pm: fix a use-after-free in kv_parse_power_table [T334689]
  - stable: {CVE-2023-52475} Input: powermate - fix use-after-free in powermate_config_complete [T334689]
  - stable: {CVE-2023-52477} usb: hub: Guard against accesses to uninitialized BOS descriptors [T334689]
  - stable: {CVE-2023-52478} HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect [T334689]
  - stable: {CVE-2023-52486} drm: Don't unref the same fb many times by mistake due to deadlock handling [T334689]
  - stable: {CVE-2023-52502} net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() [T334689]
  - stable: {CVE-2023-52502} nfc: constify several pointers to u8, char and sk_buff [T334689]
  - stable: {CVE-2023-52504} x86/alternatives: Disable KASAN in apply_alternatives() [T334689]
  - stable: {CVE-2023-52507} nfc: nci: assert requested protocol is valid [T334689]
  - stable: {CVE-2023-52510} ieee802154: ca8210: Fix a potential UAF in ca8210_probe [T334689]
  - stable: {CVE-2023-52527} ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() [T334689]
  - stable: {CVE-2023-52528} net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg [T334689]
  - stable: {CVE-2023-52566} nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() [T334689]
  - stable: {CVE-2023-52574} team: fix null-ptr-deref when team device type is changed [T334689]
  - stable: {CVE-2023-52587} IB/ipoib: Fix mcast list locking [T334689]
  - stable: {CVE-2023-52587} RDMA/IPoIB: Fix error code return in ipoib_mcast_join [T334689]
  - stable: {CVE-2023-52594} wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() [T334689]
  - stable: {CVE-2023-52597} KVM: s390: fix setting of fpc register [T334689]
  - stable: {CVE-2023-52598} s390/ptrace: handle setting of fpc register correctly [T334689]
  - stable: {CVE-2023-52602} jfs: fix slab-out-of-bounds Read in dtSearch [T334689]
  - stable: {CVE-2023-52600} jfs: fix array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52601} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52600} jfs: fix uaf in jfs_evict_inode [T334689]
  - stable: {CVE-2023-52599} jfs: fix array-index-out-of-bounds in diNewExt [T334689]
  - fix: wrong logic when allocating memory in elf module


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8]


author: xinghe <xinghe2@h-partners.com> - 1.16.1-7
changelog:
  - Type:cves
  - CVE:CVE-2023-31130 CVE-2023-31124 CVE-2023-31147
  - SUG:NA
  - DESC:fix CVE-2023-31130 CVE-2023-31124 CVE-2023-31147


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-81
changelog:
  - Update to CKBI 2.48 from NSS 3.64
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-82
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Trustis FPS Root CA"
  -    Adding:
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-81
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-80.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 2024.2.69_v8.0.303-80.0
changelog:
  - Update to CKBI 2.69_v8.0.303 from NSS 3.101.1
  -    Removing:
  -     # Certificate "Verisign Class 1 Public Primary Certification Authority - G3"
  -     # Certificate "Verisign Class 2 Public Primary Certification Authority - G3"
  -     # Certificate "Security Communication Root CA"
  -     # Certificate "Camerfirma Chambers of Commerce Root"
  -     # Certificate "Hongkong Post Root CA 1"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G6"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "FNMT-RCM"
  -    Adding:
  -     # Certificate "LAWtrust Root CA2 (4096)"
  -     # Certificate "Sectigo Public Email Protection Root E46"
  -     # Certificate "Sectigo Public Email Protection Root R46"
  -     # Certificate "Sectigo Public Server Authentication Root E46"
  -     # Certificate "Sectigo Public Server Authentication Root R46"
  -     # Certificate "SSL.com TLS RSA Root CA 2022"
  -     # Certificate "SSL.com TLS ECC Root CA 2022"
  -     # Certificate "SSL.com Client ECC Root CA 2022"
  -     # Certificate "SSL.com Client RSA Root CA 2022"
  -     # Certificate "Atos TrustedRoot Root CA ECC G2 2020"
  -     # Certificate "Atos TrustedRoot Root CA RSA G2 2020"
  -     # Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
  -     # Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
  -     # Certificate "TrustAsia Global Root CA G3"
  -     # Certificate "TrustAsia Global Root CA G4"
  -     # Certificate "CommScope Public Trust ECC Root-01"
  -     # Certificate "CommScope Public Trust ECC Root-02"
  -     # Certificate "CommScope Public Trust RSA Root-01"
  -     # Certificate "CommScope Public Trust RSA Root-02"
  -     # Certificate "D-Trust SBR Root CA 1 2022"
  -     # Certificate "D-Trust SBR Root CA 2 2022"
  -     # Certificate "Telekom Security SMIME ECC Root 2021"
  -     # Certificate "Telekom Security TLS ECC Root 2020"
  -     # Certificate "Telekom Security SMIME RSA Root 2023"
  -     # Certificate "Telekom Security TLS RSA Root 2023"
  -     # Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
  -     # Certificate "SECOM Trust.net"
  -     # Certificate "Chambers of Commerce Root"
  -     # Certificate "VeriSign Class 2 Public Primary Certification Authority - G3"
  -     # Certificate "SSL.com Code Signing RSA Root CA 2022"
  -     # Certificate "SSL.com Code Signing ECC Root CA 2022"


author: haowenchao <haowenchao@huawei.com> - 6.10-3
changelog:
  - DESC: delete -Sgit from 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/0001-Use-explicit-usr-bin-python3.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch

  , and delete BuildRequires git


author: zhangwenlong <zhangwenlong@loongson.cn> - 2.28-30.2
changelog:
  - delete rpcsvc in glibc-headers which conflicts with libnsl2-devel
  - delete libnsl.so in glibc-devel which conflicts with libnsl2-devel


author: caiyinyu <caiyinyu@loongson.cn> - 2.28-30.4
changelog:
  - Add patches:
  - 0001-glibc-2.28-sysvipc-Fix-SEM_STAT_ANY-kernel-argument-.patch
  - 0002-glibc-2.28-align-stack-in-clone-from-github.patch
  - 0003-glibc-2.28-Fix-tst-cancel21.c-to-suit-kernel-struct-.patch
  - 0004-glibc-2.28-add-vdso-support-for-gettimeofday.patch


author: loongson <service@loongnix.cn> - 2.28-30.6
changelog:
  - Add patches:
  - 0001-Improve-performance-of-memcpy.patch
  - 0002-glibc-2.28-Make-benchmark-output-valid.patch
  - 0003-glibc-2.28-Add-LoongArch-support-in-config.guess-and.patch
  - 0004-elf-Change-EM_NUM-after-add-loongarch-support.patch
  - 0005-LoongArch-Hard-Float-Support-for-functions-ll-l-rint.patch
  - 0006-LoongArch-Hard-Float-Support-for-float-point-classif.patch
  - 0007-LoongArch-Hard-Float-Support-for-functions-logb-f-__.patch
  - 0008-LoongArch-Hard-Float-Support-for-functions-scalbn-f.patch
  - 0009-LoongArch-Hard-Float-Support-for-functions-fmax-f-fm.patch
  - 0010-LoongArch-Hard-Float-Support-for-functions-copysign-.patch
  - 0011-LoongArch-Hard-Float-Support-for-fmaxmag-f-fminmag-f.patch
  - 0012-glibc-2.28-Fix-glibc-elf_machine_rela-R_LARCH_IRELAT.patch
  - 0013-glibc-2.28-Correct-macro-ARCH_SETUP_IREL.patch
  - 0014-glibc-2.28-Add-support-for-cpu-features.patch
  - 0015-glibc-2.28-Multiple-implementation-of-_dl_runtime_re.patch
  - 0016-glibc-2.28-Add-ifunc-support-for-mem-cpy-set-move-_-.patch
  - 0017-glibc-2.28-xfail-test-memcpy-test-memset-to-suit-2k1.patch
  - 0018-glibc-2.28-Delete-useless-codes-and-format-codes.patch
  - 0019-glibc-2.28-Add-ifunc-support-for-memchr_-aligned-lsx.patch
  - 0020-glibc-2.28-Add-ifunc-support-for-memrchr_-generic-ls.patch
  - 0021-glibc-2.28-Add-ifunc-support-for-mem-cpy-move-_lsx-a.patch
  - 0022-glibc-2.28-Add-ifunc-support-for-memset_lsx.patch
  - 0023-glibc-2.28-Add-new-macro-ENTRY_NO_ALIGN.patch
  - 0024-glibc-2.28-Add-ifunc-support-for-memcmp_-aligned-lsx.patch
  - 0025-glibc-2.28-Add-ifunc-support-for-rawmemchr_-aligned-.patch
  - 0026-glibc-2.28-Add-ifunc-support-for-strchr_-aligned-una.patch
  - 0027-glibc-2.28-Add-ifunc-support-for-strrchr_-aligned-ls.patch
  - 0028-glibc-2.28-Add-ifunc-support-for-strlen_-aligned-una.patch
  - 0029-glibc-2.28-Add-ifunc-support-for-strnlen_-aligned-un.patch
  - 0030-glibc-2.28-Add-ifunc-support-for-strchrnul_-aligned-.patch
  - 0031-glibc-2.28-Add-ifunc-support-for-strncmp_-aligned-un.patch
  - 0032-glibc-2.28-Add-ifunc-support-for-strcpy_-aligned-una.patch
  - 0033-glibc-2.28-Add-ifunc-support-for-stpcpy_-aligned-lsx.patch
  - 0034-glibc-2.28-Add-ifunc-support-for-strcmp_-aligned-una.patch
  - 0035-glibc-2.28-Use-common-files-ifunc-lasx.h-ifunc-lsx.h.patch
  - 0036-glibc-2.28-Delete-useless-ifndef-in-mem-.S-files.patch
  - 0037-glibc-2.28-Add-TUNABLES-support-of-glibc.cpu.hwcaps.patch
  - 0038-glibc-2.28-Add-TUNABLES-multi-options-support-of-gli.patch
  - 0039-glibc-2.28-Add-lasx-ifunc-support-of-str-mem-funcs-a.patch
  - 0040-getenv-Move-call-to-strlen-to-the-branch-it-s-used-i.patch
  - 0041-stdlib-Avoid-Wuse-after-free-in-__add_to_environ.patch
  - 0042-glibc-2.28-Add-new-lsx-impls-of-str-mem-funcs-and-ad.patch
  - 0043-glibc-2.28-Adjust-symbol-index-rindex-and-bcmp.patch
  - 0044-glibc-2.28-xfails-256-bits-str-mem-functions-to-suit.patch
  - 0045-glibc-2.28-use-latest-memmove-lasx.S.patch
  - 0046-glibc-2.28-use-latest-strchr-lasx.S.patch


author: loongson <service@loongnix.cn> - 2.28-30.7
changelog:
  - Add patches:
  - 0001-glibc-2.28-Remove-unseless-ANDROID_CHANGES-and-relat.patch
  - 0002-glibc-2.28-use-new-macro-LEAF-and-ENTRY-and-modify-r.patch
  - 0003-glibc-2.28-Fix-ifunc-str-mem-functions-xfail-problem.patch
  - 0004-glibc-2.28-Add-run-one-test-convenience-target-and-m.patch
  - 0005-glibc-2.28-remove-ABILPX32-related-code.patch
  - 0006-glibc-2.28-Refactor-code-of-raw-mem-functions.patch
  - 0007-glibc-2.28-Refactor-code-of-st-r-p-functions.patch
  - 0008-glibc-2.28-Add-new-struct-user_fp_state-in-user.h.patch
  - 0009-glibc-2.28-Redefine-macro-LEAF-ENTRY.patch


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.20.0-33
changelog:
  - RHEL-19433 Incorrect PS header handling in gstopdf
  - RHEL-16034 pdftopdf results with (N > 1)^2 copies if a file is sent to IPP printer with collate
  - RHEL-13211 redhat-lsb unnecessary pulls in cups and avahi dependencies


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1.20.0-34.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package(Weisson)


author: lichao <lichaod@uniontech.com> - 1.0.47-1.01
changelog:
  - update: update to 1.0.47
  - spec: limit opencv BuildRequires
  - fix: fix incorrect pkg replacing relation(bugid:219967)
  - spec: sw BuildRequires: opencv


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-30
changelog:
  - Add 0111-multipathd-factor-out-the-code-to-flush-a-map-with-n.patch
  - Add 0112-libmultipath-return-success-if-we-raced-to-remove-a-.patch
  - Add 0113-multipathd-Handle-losing-all-path-in-update_map.patch
  - Resolves: bz #2110485


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-31
changelog:
  - Add 0114-multipathd-ignore-duplicated-multipathd-command-keys.patch
    * Fixes bz #2133996
  - Add 0115-multipath-tools-use-run-instead-of-dev-shm.patch
    * Fixes bz #2133990
  - Resolves: bz #2133990, #2133996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-32
changelog:
  - Add 0116-kpartx-hold-device-open-until-partitions-have-been-c.patch
    * Fixes bz #2128885
  - Add 0117-libmultipath-cleanup-remove_feature.patch
  - Add 0118-libmultipath-cleanup-add_feature.patch
  - Add 0119-multipath-tests-tests-for-adding-and-removing-featur.patch
  - Add 0120-libmultipath-fix-queue_mode-feature-handling.patch
  - Add 0121-multipath-tests-tests-for-reconcile_features_with_qu.patch
  - Add 0122-libmultipath-prepare-proto_id-for-use-by-non-scsi-de.patch
  - Add 0123-libmultipath-get-nvme-path-transport-protocol.patch
  - Add 0124-libmultipath-enforce-queue_mode-bio-for-nmve-tcp-pat.patch
    * Fixes bz #2022359
  - Resolves: bz #2022359, #2128885


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-33
changelog:
  - Add 0125-multipath-add-historical-service-time-to-the-man-pag.patch
    * Fixes bz #2141996
  - Modify tests/multipath_conf_syntax/main.sh
    * fix unrelated test error
  - Resolves: bz #2141996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-34
changelog:
  - Add 0126-libmultipath-copy-mpp-hwe-from-pp-hwe.patch
    * Fixes bz #2126714
  - Cleanup multiple CI tests
  - Resolves: bz #2126714


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-35
changelog:
  - Add 0127-libmultipath-don-t-leak-memory-on-invalid-strings.patch
  - Add 0128-libmutipath-validate-the-argument-count-of-config-st.patch
  - Resolves: bz #2155560


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-36
changelog:
  - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch
  - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-select_actio.patch
  - Add 0131-libmultipath-keep-renames-from-stopping-other-multip.patch
  - Resolves: bz #2166468


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-37
changelog:
  - Fix bugzilla linked to the changes (was previously linked to
    the wrong bug, 2162537)
  - Resolves: bz #2166468


author: qinzhiben <qinzhiben@uniontech.com> - 12:4.3.6-50.0.2
changelog:
  - feat: update 12:4.3.6-50.0.1
  - feat: dhcp-server sw_64 provides dhcp
  - rebrand: modify bug url for uos


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-6
changelog:
  - fix mail storage block count parsing (#1894418)
  - MIME parser crashed when boundaries were wrong (#1888111)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-1
changelog:
  - dovecot updated to 2.3.16, pigeonhole to 0.5.16
  - fix CVE-2021-33515 plaintext commands injection (#1980014)


author: Timothy Redaelli <tredaelli@redhat.com> - 19.11.1-1
changelog:
  - Rebase DPDK to 19.11.1 (#1824905)
  - Remove dpdk-pmdinfo.py (#1801361)
  - Add Requires: rdma-core-devel libmnl-devel on x86_64 for dpdk-devel (#1813252)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-6
changelog:
  - edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch [bz#2150267]
  - Resolves: bz#2150267
    (ovmf must consider max cpu count not boot cpu count for apic mode [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-7
changelog:
  - edk2-add-8.6-machine-type-to-edk2-ovmf-cc.json.patch [RHEL-12626]
  - Resolves: RHEL-12626
    (Missing firmware descriptor with secureboot disabled in RHEL 8)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-8
changelog:
  - edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch [RHEL-7560]
  - Resolves: RHEL-7560
    (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-9
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-17587]
  - Resolves: RHEL-17587
    ([rhel8] guest fails to boot due to ASSERT error)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-10
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch [RHEL-17587]
  -  edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-17587]
  - edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch [RHEL-17587]
  - edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch [RHEL-17587]
  - Resolves: RHEL-17587
    ([rhel8] guest fails to boot due to ASSERT error)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-11
changelog:
  - edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch [RHEL-21154 RHEL-21156]
  - edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21154 RHEL-21156]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842]
  - Resolves: RHEL-21154
    (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8])
  - Resolves: RHEL-21156
    (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8])
  - Resolves: RHEL-21840
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21842
    (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-12
changelog:
  - edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Apply-uncrustify-changes.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - Resolves: RHEL-21840
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21844
    (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8])
  - Resolves: RHEL-21846
    (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8])
  - Resolves: RHEL-21848
    (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8])
  - Resolves: RHEL-21850
    (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21852
    (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13
changelog:
  - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
  - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
  - Resolves: RHEL-21158
    (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])


author: Jiang Xin <jiangxin@hygon.cn> - 20220126gitbb1bba3d77-13.0.1
changelog:
  - Support hygon CSV3 feature
  - Support SEV live migration
  - 0047-anolis-OvmfPkg-BaseMemEncryptLib-Save-memory-encrypt.patch
  - Fix the isue that interrupt is enabled in MMIO VC handler
  - 0048-OvmfPkg-AmdSev-SecretDxe-Allocate-secret-location-as.patch (fangbaoshun@hygon.cn)
  - Resolves: bz#8033


author: maqi <maqi@uniontech.com> - 20220126gitbb1bba3d77-13.0.1.01
changelog:
  - fix: add soft link to make UEFI fireware be detectable(bugid:240197)
  - fix: create symbolic link OVMF_CODE.fd(bugid:253393)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.2
changelog:
  * Wed Jul 03 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.1
  - edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Apply-uncrustify-changes.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - Resolves: RHEL-21854
    (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8])
  - Resolves: RHEL-21856
    (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8])
  - Resolves: RHEL-40099
    (CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-3.el8
changelog:
  - edk2-UefiCpuPkg-PiSmmCpuDxeSmm-pause-in-WaitForSemaphore-.patch [bz#1861718]
  - Resolves: bz#1861718
    (Very slow boot when overcommitting CPU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-4.el8
changelog:
  - edk2-OvmfPkg-SmmControl2Dxe-negotiate-ICH9_LPC_SMI_F_CPU_.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-befo.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-afte.patch [bz#1849177]
  - edk2-CryptoPkg-OpensslLib-Upgrade-OpenSSL-to-1.1.1g.patch [bz#1893806]
  - edk2-redhat-bump-OpenSSL-dist-git-submodule-to-1.1.1g-RHE.patch [bz#1893806]
  - Resolves: bz#1849177
    (OVMF: negotiate "SMI on VCPU hotplug" with QEMU)
  - Resolves: bz#1893806
    (attempt advancing RHEL8 edk2's OpenSSL submodule to RHEL8 OpenSSL 1.1.1g (or later))


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-5.el8
changelog:
  - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1892318]
  - edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch [bz#1956837]
  - Resolves: bz#1892318
    (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8])
  - Resolves: bz#1956837
    (Additional build of edk2 without SMM (dual build / sub-package) for SEV-ES)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1
changelog:
  - Rebase to edk2-stable202105 [bz#1938238]
  - Resolves: bz#1938238
    ((edk2-rebase-rhel-8.5) - rebase edk2 to edk2-stable202105 for RHEL-8.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2
changelog:
  - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1956408]
  - Resolves: bz#1956408
    (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-8.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3
changelog:
  - edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988762]
  - Resolves: bz#1988762
    (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-1.el8
changelog:
  - Rebase to latest upstream release [bz#2018386]
  - Resolves: bz#2018386
    ([rebase] update edk2 to nov '21 release (edk2-stable202111xx))


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-2
changelog:
  - edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch [bz#2112307]
  - Resolves: bz#2112307
    (Mark SEV launch secret area as reserved)


author: Camilla Conte <cconte@redhat.com> - 20220126gitbb1bba3d77-3
changelog:
  - Bumping OpenSSL version [bz# 2074834]
  - Resolves: bz# 2074834
    (edk2: sync openssl sources with rhel openssl rpm)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-4
changelog:
  - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - Resolves: bz#2164531
    (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-8])
  - Resolves: bz#2164543
    (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-8])
  - Resolves: bz#2164558
    (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-8])
  - Resolves: bz#2164581
    (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-5
changelog:
  - edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch [bz#1861743]
  - Resolves: bz#1861743
    (CVE-2019-14560 edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() [rhel-8])


author: Jacek Migacz <jmigacz@redhat.com> - 1:26.1-10
changelog:
  - Fix etags local command injection vulnerability (#2175189)
  - Fix htmlfontify.el command injection vulnerability (#2175178)
  - Fix ob-latex.el command injection vulnerability (#2180587)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
changelog:
  - Fix etags local command injection vulnerability (#2175190)
  - Fix htmlfontify.el command injection vulnerability (#2175179)
  - Fix ruby-mode.el local command injection vulnerability (#2175142)
  - Fix ob-latex.el command injection vulnerability (#2180590)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - Disable xwidgets (RHEL-14551)
  - org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
  - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
  - Add protection for LaTeX preview (CVE-2024-30204)
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
changelog:
  - Fix man.el shell injection vulnerability (RHEL-79021)
  - Eliminate use of obsolete patch syntax (RHEL-80450)


author: Xiaoping Liu <liuxiaoping@alibaba-inc.com> - 1:27.2-11.0.1.1
changelog:
  - Add doc sub package
  - update config.sub and config.guess for loongarch64 (Jingyun Hua)
  - cherry-pick `add sw patch #349896d0a48b80b530cfa5cc2bd1fc4ceff68e42`. (nijie@wxiat.com)


author: wangjie <wangjie375@huawei.com> - 2.2.9-4
changelog:
  - Type:CVE
  - ID:CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827
  - SUG:NA
  - DESC:fix CVE-2021-45960 CVE-2021-46143
         CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827


author: yangzhuangzhuang <yangzhuangzhuang1@h-partners.com> - 2.2.9-6
changelog:
  - Type:CVE
  - ID:CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315
  - SUG:NA
  - DESC:Fix CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315


author: Radovan Sroka <rsroka@redhat.com> - 1.0.2-3
changelog:
  RHEL 8.4.0 ERRATUM
  - rebase to 1.0.2
  - strong dependency on rpm/rpm-plugin-fapolicyd
  - installed dnf-plugin is dummy and we are not using it anymore
  - enabled integrity setting
  Resolves: rhbz#1887451
  - added make check
  - Adding DISA STIG during OS installation causes 'ipa-server-install' to fail
  - fixed java detection
  Resolves: rhbz#1895435
  - dnf update fails when fapolicyd is enabled
  Resolves: rhbz#1876975
  - fapolicyd breaks system upgrade, leaving system in dead state - complete fix
  Resolves: rhbz#1896875


author: Radovan Sroka <rsroka@redhat.com> - 1.0.2-7
changelog:
  - fapolicyd abnormally exits by executing sosreport
  - fixed multiple problems with unlink()
  - fapolicyd breaks system upgrade, leaving system in dead state - complete fix
  Resolves: rhbz#1943251


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.4-2
changelog:
  RHEL 8.6.0 ERRATUM
  - rebase to 1.0.4
  - added rpm_sha256_only option
  - added trust.d directory
  - allow file names with whitespace in trust files
  - use full paths in trust files
  Resolves: rhbz#1939379
  - fix libc.so getting identified as application/x-executable
  Resolves: rhbz#1989272
  - fix fapolicyd-dnf-plugin reporting as '<invalid>'
  Resolves: rhbz#1997414
  - fix selinux DSP module definition in spec file
  Resolves: rhbz#2014445


author: Radovan Sroka <rsroka@redhat.com> - 1.1-1
changelog:
  RHEL 8.6.0 ERRATUM
  - rebase to 1.1
  Resolves: rhbz#1939379
  - introduce rules.d feature
  Resolves: rhbz#2054741
  - remove pretrans scriptlet
  Resolves: rhbz#2051485


author: Radovan Sroka <rsroka@redhat.com> - 1.1-6
changelog:
  RHEL 8.6.0 ERRATUM
  - CVE-2022-1117 fapolicyd: fapolicyd wrongly prepares ld.so path
  Resolves: rhbz#2069120


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-125
changelog:
  - all agents: update metadata in non-I/O agents to Power or Network
    fencing
    Resolves: RHEL-14031


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-127
changelog:
  - fence_scsi: fix registration handling if ISID conflicts
    Resolves: RHEL-5397
  - fence_zvmip: document required user permissions in metadata/manpage
    Resolves: RHEL-14343


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-129
changelog:
  - bundled urllib3: fix CVE-2023-45803
    Resolves: RHEL-18132
  - bundled pycryptodome: fix CVE-2023-52323
    Resolves: RHEL-20915
  - bundled jinja2: fix CVE-2024-22195
    Resolves: RHEL-22174


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-129.02
changelog:
  - bundled setuptools: fix CVE-2024-6345
    Resolves: RHEL-50223
  - bundled urllib3: fix CVE-2024-37891
    Resolves: RHEL-43568

  - fence_eps: add fence_epsr2 for ePowerSwitch R2 and newer
    Resolves: RHEL-7734
  - bundled jinja2: fix CVE-2024-34064
    Resolves: RHEL-35655


author: José Expósito <jexposit@redhat.com> - 3.0.0-9
changelog:
  - Fix CVE-2024-24258 and CVE-2024-24259
    Resolves: https://issues.redhat.com/browse/RHEL-25175
    Resolves: https://issues.redhat.com/browse/RHEL-25177


author: Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
changelog:
  - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
  - Do not advertise /usb in help output (rhbz#1761144)


author: Ondrej Holy <oholy@redhat.com> - - 2:2.2.0-9
changelog:
  - CVE-2022-39282: Fix length checks in parallel driver (#2136151)
  - CVE-2022-39283: Add missing length check in video channel (#2136153)
  - CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145139)
  - CVE-2022-39318: Fix division by zero in urbdrc channel (#2145139)
  - CVE-2022-39319: Add missing length checks in urbdrc channel (#2145139)
  - CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145139)
  - CVE-2022-39347: Fix path validation in drive channel (#2145139)
  - CVE-2022-41877: Add missing length check in drive channel (#2145139)


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-1
changelog:
  - Resolves: #2018451 - Rebase of frr to version 7.5.1
  - Resolves: #1975361 - the dynamic routing setup does not work any more


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-2
changelog:
  - Resolves: #1941765 - AVCs while running frr tests on RHEL 8.4.0 Beta-1.2
  - Resolves: #1714984 - SELinux policy (daemons) changes required for package


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-6
changelog:
  - Resolves: #1939516 - frr service cannot reload itself, due to executing in the wrong SELinux context


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-7
changelog:
  - Resolves: #2128737 - out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service


author: Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
changelog:
  - Update to release 2.18.2
  - Remote code execution in recursive clones with nested submodules
    Resolves: CVE-2019-1387
  - Fixes CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,	
    CVE-2019-1352, CVE-2019-1353, CVE-2019-1354


author: Ondrej Pohorelsky <opohorel@redhat.com> - 2.13.3-1
changelog:
  - Update to version 2.13.3
  - Fixed round brackets in Provides
  - Moved manpages.tgz to look-a-side cache
  - Resolves: rhbz#2021549, rhbz#1870080, rhbz#1866441


author: Patsy Griffin <patsy@redhat.com> - 2.28-251.19
changelog:
  - libio: Fix a deadlock after fork in popen
  - libio: Correctly link tst-popen-fork against libpthread (RHEL-86018)


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-251.0.1.22
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)
  - aarch64: Increase small and medium cases for __memcpy_generic (bug#7060) (Kaiqiang Wang)
  - Add Hygon Support (Jing Li)
  - Sync loongarch64 code to lnd.36. (fanpeng@loongson.cn)
  - SPECS: define glibc_ldso for LoongArch. (fanpeng@loongson.cn)


author: zengwei <zengwei1@uniontech.com> - 2.28-251.0.1.22.1
changelog:
  - feat: sync optmize from upstream
  - arch: loongarch64 shadow stack
  - optmize: from upstream bug#214497


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.1.2-8
changelog:
  - Missing fipschecks added into build process (bug #1553679)
  - --enable-fat option added to %configure (bug #1493218)


author: Jakub Martisko <jamartis@redhat.com> - 1:6.1.2-9
changelog:
  - Add support for intel CET and -fcf-protection
  - Add missing compiler/linker flags
  Related: #1630567


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
changelog:
  - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
  - resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
changelog:
  - update to 7.5.15 tagged upstream community sources, see CHANGELOG
  - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
  - resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
  - resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
  - resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
  - resolve CVE-2021-23648 sanitize-url: XSS
  - resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
  - declare Node.js dependencies of subpackages
  - make vendor and webpack tarballs reproducible


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
changelog:
  - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
  - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
  - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
changelog:
  - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
  - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
  - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
  - resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
  - run integration tests in check phase
  - update FIPS patch with latest changes in Go packaging


author: zhangxianting <zhangxianting@uniontech.com> 7.5.15-4.01
changelog:
  - cve: CVE-2022-2880 CVE-2022-27664 CVE-2022-39229 CVE-2022-41715
  - arch: support loongarch64
  - spec: Use cn proxy for go build


author: Sam Feifer <sfeifer@redhat.com> 7.5.15-5
changelog:
  - resolve RHEL-13284
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-7
changelog:
  - resolve RHEL-12649
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: Andreas Gerstmayr <agerstmayr@redhat.com> 2.0.2-2
changelog:
  - vector: do not show all cgroups in the container overview dashboard in case no containers are present on the system


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.0.0-1
changelog:
  - update to 3.0.0 tagged upstream community sources, see CHANGELOG
  - bundle golang dependencies and (optionally) node.js dependencies


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.1.0-1
changelog:
  - update to 3.1.0 tagged upstream community sources, see CHANGELOG
  - remove unused cryptographic implementations


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.2.0-2
changelog:
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode


author: Julien Rische <jrische@redhat.com> - 1.2.0-1
changelog:
  - New release 1.2.0
  - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields
  - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings
  - Fix CVE-2023-25565: incorrect free when decoding target information
  - Fix CVE-2023-25566: memory leak when parsing usernames
  - Fix CVE-2023-25567: out-of-bounds read when decoding target information
  - Resolves: rhbz#2181313


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
changelog:
  - CVE-2023-37327: integer overflow leading to heap overwrite in
    FLAC image tag handling
  - Resolves: RHEL-19469


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
changelog:
  - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
    CVE-2024-47613
    Resolves: RHEL-70949, RHEL-70962, RHEL-70936, RHEL-71022
    Resolves: RHEL-70998


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Michal Ruprich <mruprich@redhat.com> - 3.5-2
changelog:
  - Resolves: #1647413 - iperf3 with option --sctp in client mode fails with error 'iperf3: unrecognized option --sctp'


author: Michal Ruprich <mruprich@redhat.com> - 3.5-4
changelog:
  - Resolves: #1665142 - [RFE] enable SCTP support in iperf3
  - Resolves: #1656429 - option --udp-counters-64bit shown in --help output but not in man page
  - Resolves: #1700497 - [RFE] enable SSL support in iperf3


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230515-115.gitd1962891
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - [RHEL8] Add latest NVIDIA signed firmware for Turing GPUs and later
  Resolves: rhbz#2183606


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230711-116.gitd3f66064
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - AMD GPU firmware update: fix PSR-SU issues with kernel 6.2 or later
  Resolves: rhbz#2218670


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230808-117.git0ab353f8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi32 dGPU firmware
  - Update to fix multi monitor behind TBT3 dock & random flickers
  - AMD Zen2 firmware update for cross-process information leak
  Resolves: rhbz#2047482, rhbz#2227846, rhbz#2227153


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230824-118.git0e048b06
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - AMD Zen3 and Zen4 firmware update for return address predictor velunerability
  Resolves: rhbz#2230415


author: Denys Vlasenko <dvlasenk@redhat.com> - 20231121-119.git9552083a
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update AMD cpu microcode
  - hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
  Resolves: RHEL-16721, RHEL-14260


author: Denys Vlasenko <dvlasenk@redhat.com> - 20231121-120.git9552083a
changelog:
  - Work around absense of rdfind during build
  - Add file directives for new iwlwifi files
  Resolves: RHEL-16721, RHEL-14260


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240111-121.gitb3132c18
changelog:
  - Pass --ignore-duplicates to copy-firmware.sh
  - AMD Zen3 and Zen4: fix for INVD instruction causing loss of SEV-ES guest machine memory integrity
  Resolves: RHEL-13982


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240610-122.git90df68d2
changelog:
  - [Intel 8.10 FEAT] [SPR][EMR] QAT firmware update available (RHEL-15607)
  - CVE-2023-31346 AMD SEV: Reserved fields in guest message responses may not be zero initialized [rhel-8.10.0] (RHEL-35596)
  - amd-ucode early loading broken [rhel-8] (RHEL-16799)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - linux-firmware: Add firmware for Lenovo Thinkbooks
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SDMA 6.0.2 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update raven firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update smu 13.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update picasso firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update SDMA 6.0.1 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update SMU 13.0.6 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: add support for PSP 14.0.1
  - amdgpu: add support for VPE 6.1.1
  - amdgpu: add support for VCN 4.0.6
  - amdgpu: add support for SDMA 6.1.1
  - amdgpu: add support for GC 11.5.1
  - amdgpu: Add support for DCN 3.5.1
  - cnm: update chips&media wave521c firmware.
  - linux-firmware: Add ordinary firmware for RTL8821AU device
  - amdgpu: add new ISP 4.1.1 firmware
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Amphion: Update vpu firmware
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - i915: Add BMG DMC v2.06
  - linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
  - linux-firmware: Update firmware tuning for HP Consumer Laptop
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
  - rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
  - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
  - linux-firmware: Add firmware and tuning for Lenovo Y770S
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Add firmware for Cirrus CS35L56 for various HP laptops
  - i915: Update Xe2LPD DMC to v2.20
  - linux-firmware: Remove Calibration Firmware and Tuning for CS35L41
  - linux-firmware: Add firmware for Lenovo Thinkbook 13X
  - ASoC: tas2781: Add dsp firmware for Thinkpad ICE-1 laptop
  - amdgpu: add DMCUB 3.5 firmware
  - amdgpu: add VPE 6.1.0 firmware
  - amdgpu: add VCN 4.0.5 firmware
  - amdgpu: add UMSCH 4.0.0 firmware
  - amdgpu: add SDMA 6.1.0 firmware
  - amdgpu: add PSP 14.0.0  firmware
  - amdgpu: add GC 11.5.0 firmware
  - amdgpu: update license date
  - Montage: update firmware for Mont-TSSE
  - linux-firmware: Add tuning parameter configs for CS35L41 Firmware
  - linux-firmware: Fix firmware names for Laptop SSID 104316a3
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Legion Slim 7 16ARHA7
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - iwlwifi: add gl FW for core87-44 release
  - iwlwifi: add ty/So/Ma firmwares for core87-44 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core87-44 release
  - nvidia: Update Tegra210 XUSB firmware to v50.29
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update psp 13.0.11 firmware
  - amdgpu: update gc 11.0.4 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update renoir firmware
  - amdgpu: update vcn 4.0.2 firmware
  - amdgpu: update sdma 6.0.1 firmware
  - amdgpu: update psp 13.0.4 firmware
  - amdgpu: update gc 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update vcn 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update sdma 6.0.2 firmware
  - amdgpu: update ipsp 13.0.7 firmware
  - amdgpu: update gc 11.0.2 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update raven firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update smu 13.0.10 firmware
  - amdgpu: update sdma 6.0.3 firmware
  - amdgpu: update psp 13.0.10 firmware
  - amdgpu: update gc 11.0.3 firmware
  - amdgpu: update vcn 3.1.2 firmware
  - amdgpu: update psp 13.0.5 firmware
  - amdgpu: update gc 10.3.6 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update vcn 4.0.3 firmware
  - amdgpu: update smu 13.0.6 firmware
  - amdgpu: update psp 13.0.6 firmware
  - amdgpu: update gc 9.4.3 firmware
  - amdgpu: update vcn 4.0.0 firmware
  - amdgpu: update smu 13.0.0 firmware
  - amdgpu: update sdma 6.0.0 firmware
  - amdgpu: update psp 13.0.0 firmware
  - amdgpu: update gc 11.0.0 firmware
  - amdgpu: update  firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update gc 10.3.7 firmware
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.9
  - Merge https://github.com/pkshih/linux-firmware into rtw
  - ath10k: WCN3990: hw1.0: add qcm2290 firmware API file
  - ath10k: WCN3990: hw1.0: move firmware back from qcom/ location
  - i915: Add DG2 HuC 7.10.15
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - mekdiatek: Update mt8186 SOF firmware to v2.0.1
  - rtw89: 8852c: update fw to v0.27.56.14
  - rtw89: 8922a: add firmware v0.35.18.0
  - rtw88: Add RTL8703B firmware v11.0.0
  - linux-firmware: Add firmware for Cirrus CS35L56 for Dell laptops
  - Montage: update firmware for Mont-TSSE
  - WHENCE: Link the Raspberry Pi CM4 and 5B to the 4B
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX200
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9560
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9260
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.8
  - imx: sdma: update firmware to v3.6/v4.6
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - iwlwifi: update 9000-family firmwares to core85-89
  - rtl_bt: Update RTL8852A BT USB firmware to 0xD9D6_17DA
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Thinkbook 16P Laptops
  - amdgpu: Update VCN firmware binaries
  - Intel IPU2: Add firmware files
  - brcm: Add nvram for the Acer Iconia One 7 B1-750 tablet
  - i915: Add Xe2LPD DMC v2.18
  - i915: Update MTL DMC v2.21
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - linux-firmware: add firmware for MT7996
  - xe: First GuC release for LNL and Xe
  - i915: Add GuC v70.20.0 for ADL-P, DG1, DG2, MTL and TGL
  - linux-firmware: Add CS35L41 firmware for Lenovo Legion 7i gen7 laptop (16IAX7)
  - brcm: Add nvram for the Asus Memo Pad 7 ME176C tablet
  - ice: update ice DDP package to 1.3.36.0
  - Intel IPU3 ImgU: Move firmware file under intel/ipu
  - Intel IPU6: Move firmware binaries under ipu/
  - check_whence: Add a check for duplicate link entries
  - WHENCE: Clean up section separators
  - linux-firmware: Add CS35L41 firmware for additional ASUS Zenbook 2023 models
  - panthor: Add initial firmware for Gen10 Arm Mali GPUs
  - amdgpu: DMCUB Updates for DCN321: 7.0.38.0
  - amdgpu: DMCUB updates for Yellow Carp: 4.0.68.0
  - qcom: update venus firmware file for v5.4
  - Montage: add firmware for Mont-TSSE
  - amdgpu: update DMCUB to v0.0.203.0 for DCN314 and DCN32
  - linux-firmware: Remove 2 HP laptops using CS35L41 Audio Firmware
  - linux-firmware: Fix filenames for some CS35L41 firmwares for HP
  - linux-firmware: wilc1000: update WILC1000 firmware to v16.1.2
  - rtl_nic: add firmware for RTL8126A
  - linux-firmware: intel: Add IPU6 firmware binaries
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37
  - qcom: Add Audio firmware for SM8550 HDK
  - Merge tag 'amd-2024-01-30.2' into mlimonci/amd-2024-01-30.2
  - Revert "amdgpu: DMCUB updates for various AMDGPU ASICs"
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - brcm: Add brcmfmac43430-sdio.xxx.txt nvram for the Chuwi Hi8 (CWI509) tablet
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: Add Audio firmware for SM8650 MTP
  - linux-firmware: Add firmware for Cirrus CS35L41 on HP Consumer Laptops
  - Intel Bluetooth: Make spacing consistent with rest of WHENCE
  - amdgpu: update raven2 firmware
  - amdgpu: update raven firmware
  - amdgpu: update SDMA 5.2.7 firmware
  - amdgpu: update PSP 13.0.8 firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update SDMA 5.2.6 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: add GC 11.0.1 rlc_1 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update picasso firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update navi14 firmware
  - amdgpu: add VCN 4.0.3 firmware
  - amdgpu: add SDMA 4.4.2 firmware
  - amdgpu: add SMU 13.0.6 firmware
  - amdgpu: add PSP 13.0.6 firmware
  - amdgpu: Add GC 9.4.3 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SMU 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update aldebaran firmware
  - linux-firmware: Update AMD cpu microcode
  - RTL8192E: Remove old realtek WiFi firmware
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - amdgpu: DMCUB updates for DCN314
  - qcom: Update the firmware for Adreno a630 family of GPUs
  - cirrus: Add CS35L41 firmware for Legion Slim 7 Gen 8 laptops
  - linux-firmware: Add firmware for Cirrus CS35L41 for various Dell laptops
  - linux-firmware: update firmware for qat_4xxx devices
  Resolves: RHEL-35596, RHEL-16799, RHEL-15607


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240715-123.git4c8fb21e
changelog:
  - [Intel 8.10 FEAT] [SRF] QAT_402XX firmware update (RHEL-47353)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - qcom: move signed x1e80100 signed firmware to the SoC subdir
  - qcom: add video firmware file for vpu-3.0
  - amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics
  - qcom: add gpu firmwares for x1e80100 chipset
  - linux-firmware: add firmware for qat_402xx devices
  - amdgpu: update raven firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update PSP 13.0.8 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update picasso firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update SDMA 6.0.1 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update VPE 6.1.1 firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update SDMA 6.1.1 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update SDMA 6.1.0 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SMU 13.0.7 firmware
  - amdgpu: update SDMA 6.0.2 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update aldebaran firmware
  - linux-firmware: Update AMD cpu microcode
  - intel: avs: Add topology file for I2S Analog Devices 4567
  - intel: avs: Add topology file for I2S Nuvoton 8825
  - intel: avs: Add topology file for I2S Maxim 98927
  - intel: avs: Add topology file for I2S Maxim 98373
  - intel: avs: Add topology file for I2S Maxim 98357a
  - intel: avs: Add topology file for I2S Dialog 7219
  - intel: avs: Add topology file for I2S Realtek 5663
  - intel: avs: Add topology file for I2S Realtek 5640
  - intel: avs: Add topology file for I2S Realtek 5514
  - intel: avs: Add topology file for I2S Realtek 298
  - intel: avs: Add topology file for I2S Realtek 286
  - intel: avs: Add topology file for I2S Realtek 274
  - intel: avs: Add topology file for Digital Microphone Array
  - intel: avs: Add topology file for HDMI codecs
  - intel: avs: Add topology file for HDAudio codecs
  - Add a copy of Apache-2.0
  - intel: avs: Update AudioDSP base firmware for APL-based platforms
  - linux-firmware: Add ISH firmware file for Intel Lunar Lake platform
  - amdgpu: update DMCUB to v0.0.224.0 for Various AMDGPU Asics
  - cirrus: cs35l41: Update various firmware for ASUS laptops using CS35L41
  - amdgpu: Update ISP FW for isp v4.1.1
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.2.0
  - qcom: Add AIC100 firmware files
  - amlogic: Update bluetooth firmware binary
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - linux-firmware: Update firmware file for Intel Bluetooth Pulsar core
  - rtl_bt: Update RTL8822C BT UART firmware to 0xB5D6_6DCB
  - rtl_bt: Update RTL8822C BT USB firmware to 0xAED6_6DCB
  - amdgpu: update DMCUB to v0.0.222.0 for DCN314
  - iwlwifi: add ty/So/Ma firmwares for core88-87 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core88-87 release
  - linux-firmware: add new cc33xx firmware for cc33xx chips
  - cirrus: cs35l56: Update firmware for Cirrus CS35L56 for ASUS UM5606 laptop
  - cirrus: cs35l56: Update firmware for Cirrus CS35L56 for various ASUS laptops
  - Merge https://github.com/zijun-hu/qca_btfw into qca
  Resolves: RHEL-47353


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240827-141.git3cff7109
changelog:
  - AMD SEV: IOMMU improperly handles certain special address leading to a loss of guest integrity (RHEL-54256)
  - AMD SEV: Incomplete system memory cleanup in SEV firmware corrupt guest private memory (RHEL-54237)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: DMCUB updates forvarious AMDGPU ASICs
  - rtw89: 8922a: add fw format-1 v0.35.41.0
  - linux-firmware: update firmware for MT7925 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
  - rtl_bt: Add firmware and config files for RTL8922A
  - rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
  - rtl_bt: de-dupe identical config.bin files
  - rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
  - linux-firmware: Update AMD SEV firmware
  - linux-firmware: update firmware for MT7996
  - Revert "i915: Update MTL DMC v2.22"
  - Merge tag 'amd-2024-08-12' of https://gitlab.freedesktop.org/drm/firmware into amd-2024-08-12
  - ath12k: WCN7850 hw2.0: update board-2.bin
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
  - ath11k: QCA2066 hw2.1: add board-2.bin
  - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
  - qcom: vpu: add video firmware for sa8775p
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: update path for video firmware for vpu-1/2/3.0
  - Merge https://github.com/zijun-hu/qca_btfw into qca_btfw
  - Merge tag 'rtw-fw-2024-08-08' of https://github.com/pkshih/linux-firmware into rtw89
  - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00642
  - rtw89: 8852c: add fw format-1 v0.27.97.0
  - rtw89: 8852bt: add firmware 0.29.91.0
  - amdgpu: Update ISP FW for isp v4.1.1
  - Merge tag 'intel-2024-08-02' of https://gitlab.freedesktop.org/drm/firmware into intel-20240805
  - Merge https://github.com/zijun-hu/qca_btfw into list-20240802
  - mediatek: Update mt8195 SOF firmware
  - Merge tag 'amd-2024-08-02' of https://gitlab.freedesktop.org/drm/firmware into amd-20240802
  - amdgpu: DMCUB updates for DCN314
  - xe: First GuC release v70.29.2 for BMG
  - xe: Add GuC v70.29.2 for LNL
  - i915: Add GuC v70.29.2 for ADL-P, DG1, DG2, MTL, and TGL
  - i915: Update MTL DMC v2.22
  - i915: update MTL GSC to v102.0.10.1878
  - xe: Add BMG HuC 8.2.10
  - xe: Add GSC 104.0.0.1161 for LNL
  - xe: Add LNL HuC 9.4.13
  - i915: update DG2 HuC to v7.10.16
  - amdgpu: Update ISP FW for isp v4.1.1
  - amdgpu: Update ISP FW for isp v4.1.1
  - amdgpu: add new ISP 4.1.1 firmware
  - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00641
  - amdgpu: update DMCUB to v0.0.227.0 for DCN35 and DCN351
  - Merge tag 'iwlwifi-fw-2024-07-25' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwlwifi/linux-firmware into iwlfifi-fw-2024-07
  - Revert "iwlwifi: update ty/So/Ma firmwares for core89-58 release"
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - iwlwifi: add gl FW for core89-58 release
  - iwlwifi: update ty/So/Ma firmwares for core89-58 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core89-58 release
  - mediatek: Update mt8195 SOF firmware and sof-tplg
  - ASoC: tas2781: fix the license issue for tas781 firmware
  - rtl_bt: Update RTL8852B BT USB FW to 0x048F_4008
  - .gitignore: Ignore intermediate files
  - i915: Update Xe2LPD DMC to v2.21
  Resolves: RHEL-54256, RHEL-54237


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Switch to EA mode.
  - Update tarball generation script to use PR3822 which handles
      JDK-8233228 & JDK-8035166 changes
  - Remove RH1868759 patch as this is now resolved upstream by JDK-8258833.
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Require tzdata 2020f due to JDK-8259048
  - Require tzdata 2021a due to JDK-8260356
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Ao Qi <aoqi@loongson.cn> - 1:1.8.0.292.b10-8.1.8
changelog:
  - 版本升级，由jdk8u282-b08升级至jdk8u292-b10
  - SHA1/SHA256 Intrinsics优化，使得SPECjvm2008中的crypto.signverify项提升71%
  - AES Intrinsics优化，使得SPECjvm2008中的crypto.signverify项提升约6.14%
  - 优化C2中Rotation操作，使得SPECjvm2008中的crypto.signverify在LoongArch和MIPS上分别提升了4.3%和2.6%
  - 数组拷贝优化，使得SPECjvm2008中的serial项提升6.4%
  - 优化C2中一些立即数为0时的访存操作
  - 去除输入法跟随功能
  - jdk中不附带ChangeLog文件
  - 解决了一处解释器中由于乱序执行可能导致的随机崩溃问题
  - 修复DaCapo eclipse个别条件下随机崩溃问题
  - 修复NMT相关崩溃问题


author: Ao Qi <aoqi@loongson.cn> - 1:1.8.0.302.b08-8.1.9
changelog:
  - 版本升级，由jdk8u292-b10升级至jdk8u302-b08
  - [LoongArch] 解决了一处在堆设置大于128G时可能触发的随机崩溃问题
  - [LoongArch] 实现trampoline stub，解决patch原子性问题


author: Ao Qi <aoqi@loongson.cn> - 1:1.8.0.332.b09-8.1.11
changelog:
  - 版本升级，由8u312-b07升级至8u322-b06
  - 版本升级，由8u322-b06升级至8u332-b09
  - [LoongArch] C1和分层编译支持，优化性能
  - [LoongArch] C2向量指令优化
  - [LoongArch] 优化GC停顿时间
  - [LoongArch] CRC32 Intrinsics优化
  - 优化ArrayFill
  - [LoongArch] 优化Math.multiplyHigh
  - [LoongArch] AllocatePrefetch相关参数调优
  - [LoongArch] InlineSmallCode调优，默认值设为2000
  - [LoongArch] 使用cpucfg识别特性
  - 修复Redefine Class可能导致的偶发崩溃
  - 修复jvmti相关的随机错误
  - 修复push2/pop2入栈和出栈顺序问题
  - 修复Early Return可能导致浮点值恢复错误问题
  - 修复ori2s立即数越界问题


author: Ao Qi <aoqi@loongson.cn> - 1:1.8.0.352.b08-8.1.12
changelog:
  - 版本升级，由8u332-b09升级至8u342-b07
  - 版本升级，由8u342-b07升级至8u345-b01
  - 版本升级，由8u345-b01升级至8u352-b08
  - 修复GC偶发崩溃问题
  - 删除各别字体文件
  - OpenJFX更新至8u212-b02，修复遗漏的WTF_CPU_KNOWN
  - [LoongArch] 解决社区版本编译器构建JDK时遇到的user_regs_struct相关错误
  - [MIPS] 提高ReservedCodeCacheSize默认值至120M，解决长时间运行偶发变慢问题


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-3
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2121266


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
  - Bump FreeType bundled version to 2.12.1 following JDK-8290334
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources
  - Resolves: rhbz#2131862
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.2.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Drop local copy of JDK-8275535 which is finally upstream
  - Related: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-2
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase FIPS support against 11.0.19+6
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Liwei Ge <geliwei@openanolis.org> - 1:11.0.19.0.7-1.0.1
changelog:
  - LoongArch64 init support (aoqi <aoqi@loongson.cn>)
  - Adjust loongarch64 patch (geliwei@openanolis.org)
  - Set default java for loongarch64 (geliwei@openanolis.org)


author: lvgenggeng <lvgenggeng@uniontech.com> - 1:11.0.19.0.7-1.0.1.02
changelog:
  - cve: CVE-2023-2004
  - cve: CVE-2023-22006
  - cve: CVE-2023-22036
  - cve: CVE-2023-22041
  - cve: CVE-2023-22045
  - cve: CVE-2023-22049


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-2
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Switch to GA mode for release
  - Resolves: rhbz#2106515


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-2
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119527


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.3.ea
changelog:
  - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
  - Resolves: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.5.ea
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
  - Resolves: rhbz#1996182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-3
changelog:
  - Update release notes to document the major changes between OpenJDK 11 & 17.
  - Resolves: rhbz#1994084


author: Ao Qi <aoqi@loongson.cn> - 1:17.0.3.0.7-17.2.0
changelog:
  - 版本升级，由17+35升级至17.0.1+12
  - 版本升级，由17.0.1+12升级至17.0.2+8
  - 版本升级，由17.0.2+8升级至17.0.3+7
  - [LoongArch] 优化GC停顿时间
  - [LoongArch] 使用向量指令优化Array Copy
  - [LoongArch] 优化Integer.rotateLeft和Integer.rotateRight
  - [LoongArch] 优化Math.copySign
  - [LoongArch] 优化itable Stub
  - [LoongArch] AllocatePrefetch相关参数调优
  - 修复push2/pop2入栈和出栈顺序问题
  - 修复ori2s立即数越界问题


author: Ao Qi <aoqi@loongson.cn> - 1:17.0.5.0.8-17.3.0
changelog:
  - 版本升级，由17.0.3+7升级至17.0.4+8
  - 版本升级，由17.0.4+8升级至17.0.5+8
  - [LoongArch] Shenandoah GC支持
  - [LoongArch] JVMCI支持
  - OpenJFX支持，版本为17.0.4
  - 调整INTPRESSURE/FLOATPRESSURE
  - [LoongArch] 优化Math.floor，Math.ceil和Math.rint
  - [LoongArch] 优化Math.sin和Math.cos
  - [LoongArch] 优化常用字符集的编解码效率
  - [LoongArch] 优化数组拷贝
  - [LoongArch] 优化String.indexOf
  - [LoongArch] 减少Halt节点生成stop的机会，优化性能
  - [LoongArch] 实现ZSaveLiveRegister，减少保存和恢复寄存器数量，优化ZGC性能
  - [LoongArch] 解决社区版本编译器构建JDK时遇到的user_regs_struct相关错误
  - [MIPS] 提高ReservedCodeCacheSize默认值至120M，解决长时间运行偶发变慢问题


author: daifan <daifan@uniontech.com> - 4.19.0-91.132.4
changelog:
  - UOS: loongarch/config: enable CONFIG_TXGBE and CONFIG_NGBE
  - UOS: loongarch/config: enable CONFIG_SCSI_MPT3SAS
  - (CVE-2023-0394)ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
  - (CVE-2023-0266)ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
  - (CVE-2022-47929)net: sched: disallow noqueue for qdisc classes
  - (CVE-2022-36280)drm/vmwgfx: Validate the box size for the snooped cursor
  - (CVE-2022-45934)Bluetooth: L2CAP: Fix u8 overflow
  - (CVE-2021-4034)exec: Force single empty string when argv is empty
  - (CVE-2022-4662)USB: core: Prevent nested device-reset calls
  - (CVE-2022-3111)power: supply: wm8350-power: Add missing free in free_charger_irq
  - (CVE-2022-3107)hv_netvsc: Add check for kvmalloc_array
  - (CVE-2022-3643)xen/netback: Ensure protocol headers don't fall in the non-linear area
  - (CVE-2022-42703)mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
  - (CVE-2022-42896)Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
  - (CVE-2022-3521)kcm: avoid potential race in kcm_tx_work
  - (CVE-2022-4095)staging: rtl8712: fix use after free bugs
  - (CVE-2022-41858)drivers: net: slip: fix NPD bug in sl_tx_timeout()
  - LoongArch: Fix the 10 Gigabit network card cannot be used


author: daifan <daifan@uniontech.com> - 4.19.0-91.132.7
changelog:
  - uos: update to wangxun driver of net
  - UOS: radeon:Refactoring submitted 1998e6355fa8 to add architectural distinction to the code introduced by Loongson
  - Revert "sched: Reinit task's vruntime if a task sleep over 200 days"
  - sched/fair: Fix enqueue_task_fair() warning some more
  - sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list
  - sched/fair: fix enqueue_task_fair warning
  - anolis: sched: fix some warnings with allnoconfig
  - anolis: sched: Fix the bug that compile failure with CONFIG_SCHED_DEBUG off
  - sched: Reinit task's vruntime if a task sleep over 200 days


author: daifan <daifan@uniontech.com> - 4.19.0-91.132.8
changelog:
  - stable: {CVE-2024-1086} netfilter: nf_tables: reject QUEUE/DROP verdict parameters [T310775]
  - stable: {CVE-2024-26602} sched/membarrier: reduce the ability to hammer on sys_membarrier [T351223]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.132.9
changelog:
  - uos: fix kabi change of struct css_set [T371989]
  - uos: add uos kabi-check [T00000]
  - uos: add srpm source for lts-1050u2 [T00000]
  - stable: irqchip/gic-v3-its: Fix potential VPE leak on error [T371989]
  - stable: {CVE-2022-49667} net: bonding: fix use-after-free after 802.3ad slave unbind [T371989]
  - stable: {CVE-2022-48960} net: hisilicon: Fix potential use-after-free in hix5hd2_rx() [T371989]
  - stable: {CVE-2022-49031} iio: health: afe4403: Fix oob read in afe4403_read_raw [T371989]
  - stable: {CVE-2022-48672} of: fdt: fix off-by-one error in unflatten_dt_nodes() [T371989]
  - stable: {CVE-2021-47549} sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl [T371989]
  - stable: {CVE-2021-47521} can: sja1000: fix use after free in ems_pcmcia_add_card() [T371989]
  - stable: {CVE-2022-48988} memcg: fix possible use-after-free in memcg_write_event_control() [T371989]
  - stable: {CVE-2021-47301} igb: Fix use-after-free error during reset [T371989]
  - stable: {CVE-2022-48651} ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header [T371989]
  - stable: {CVE-2021-47259} NFS: Fix use-after-free in nfs4_init_client() [T371989]
  - stable: {CVE-2021-47235} net: ethernet: fix potential use-after-free in ec_bhf_remove [T371989]
  - stable: {CVE-2022-48851} staging: gdm724x: fix use after free in gdm_lte_rx() [T371989]
  - stable: {CVE-2021-47310} net: ti: fix UAF in tlan_remove_one [T371989]
  - stable: {CVE-2022-49032} iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw [T371989]
  - stable: {CVE-2022-48912} netfilter: fix use-after-free in __nf_register_net_hook() [T371989]
  - stable: {CVE-2022-49029} hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails [T371989]
  - stable: {CVE-2022-49489} drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume [T371989]
  - stable: {CVE-2022-48956} ipv6: avoid use-after-free in ip6_fragment() [T371989]
  - stable: {CVE-2022-48962} net: hisilicon: Fix potential use-after-free in hisi_femac_rx() [T371989]
  - stable: {CVE-2021-47598} sch_cake: do not call cake_destroy() from cake_init() [T371989]
  - stable: {CVE-2021-47346} coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() [T371989]
  - stable: {CVE-2021-47309} net: validate lwtstate->data before returning from skb_tunnel_info() [T371989]
  - stable: {CVE-2021-47609} firmware: arm_scpi: Fix string overflow in SCPI genpd driver [T371989]
  - stable: {CVE-2021-47361} mcb: fix error handling in mcb_alloc_bus() [T371989]
  - stable: {CVE-2022-49015} net: hsr: Fix potential use-after-free [T371989]
  - stable: {CVE-2022-48926} usb: gadget: rndis: add spinlock for rndis response list [T371989]
  - stable: {CVE-2021-46966} ACPI: custom_method: fix potential use-after-free issue [T371989]
  - stable: {CVE-2021-47656} jffs2: fix use-after-free in jffs2_clear_xattr_subsystem [T371989]
  - stable: {CVE-2022-49685} iio: trigger: sysfs: fix use-after-free on remove [T371989]
  - stable: {CVE-2021-47571} staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() [T371989]
  - stable: {CVE-2021-47520} can: pch_can: pch_can_rx_normal: fix use after free [T371989]
  - stable: {CVE-2021-47634} ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl [T371989]
  - stable: {CVE-2021-47456} can: peak_pci: peak_pci_remove(): fix UAF [T371989]
  - stable: {CVE-2022-48742} rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() [T371989]
  - stable: {CVE-2021-47636} ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() [T371989]
  - stable: {CVE-2022-49388} ubi: ubi_create_volume: Fix use-after-free when volume creation failed [T371989]
  - stable: {CVE-2021-47358} staging: greybus: uart: fix tty use after free [T371989]
  - stable: {CVE-2021-47245} netfilter: synproxy: Fix out of bounds when parsing TCP options [T371989]
  - stable: {CVE-2022-49059} nfc: nci: add flush_workqueue to prevent uaf [T371989]
  - stable: {CVE-2021-47541} net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() [T371989]
  - stable: {CVE-2022-49416} wifi: mac80211: fix use-after-free in chanctx code [T371989]
  - stable: {CVE-2022-48855} sctp: fix kernel-infoleak for SCTP sockets [T371989]
  - stable: {CVE-2021-47194} cfg80211: call cfg80211_stop_ap when switch from P2P_GO type [T371989]
  - stable: {CVE-2022-49478} media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init [T371989]
  - stable: {CVE-2022-48754} phylib: fix potential use-after-free [T371989]
  - stable: {CVE-2021-47243} sch_cake: Fix out of bounds when parsing TCP options and header [T371989]
  - stable: {CVE-2022-49058} cifs: potential buffer overflow in handling symlinks [T371989]
  - stable: {CVE-2022-48991} mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths [T371989]
  - stable: {CVE-2022-49014} net: tun: Fix use-after-free in tun_detach() [T371989]
  - stable: {CVE-2022-48732} drm/nouveau: fix off by one in BIOS boundary checking [T371989]
  - stable: {CVE-2022-49085} drbd: Fix five use after free bugs in get_initial_state [T371989]
  - stable: {CVE-2021-47403} ipack: ipoctal: fix module reference leak [T371989]
  - stable: {CVE-2022-48966} net: mvneta: Prevent out of bounds read in mvneta_config_rss() [T371989]
  - stable: {CVE-2021-47500} iio: mma8452: Fix trigger reference couting [T371989]
  - stable: {CVE-2022-49647} cgroup: Use separate src/dst nodes when preloading css_sets for migration [T371989]
  - stable: {CVE-2021-47288} media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() [T371989]
  - stable: {CVE-2021-47589} igbvf: fix double free in `igbvf_probe` [T371989]
  - stable: {CVE-2022-48967} NFC: nci: Bounds check struct nfc_target arrays [T371989]
  - stable: {CVE-2022-48948} usb: gadget: uvc: Prevent buffer overflow in setup handler [T371989]
  - stable: {CVE-2022-49700} mm/slub: add missing TID updates on slab deactivation [T371989]
  - stable: {CVE-2022-49087} rxrpc: fix a race in rxrpc_exit_net() [T371989]
  - stable: {CVE-2022-48717} ASoC: max9759: fix underflow in speaker_gain_control_put() [T371989]
  - stable: {CVE-2021-47311} net: qcom/emac: fix UAF in emac_remove [T371989]
  - stable: {CVE-2022-49275} can: m_can: m_can_tx_handler(): fix use after free of skb [T371989]
  - stable: {CVE-2021-47483} regmap: Fix possible double-free in regcache_rbtree_exit() [T371989]
  - stable: {CVE-2024-26976} KVM: Always flush async #PF workqueue when vCPU is being destroyed [T371989]
  - stable: {CVE-2024-44999} gtp: pull network headers in gtp_dev_xmit() [T371989]
  - stable: {CVE-2023-52885} SUNRPC: Fix UAF in svc_tcp_listen_data_ready() [T371989]
  - stable: {CVE-2024-46800} sch/netem: fix use after free in netem_dequeue [T371989]
  - stable: {CVE-2024-26852} net/ipv6: avoid possible UAF in ip6_route_mpath_notify() [T371989]
  - stable: {CVE-2024-41046} net: ethernet: lantiq_etop: fix double free in detach [T371989]
  - stable: {CVE-2024-53061} media: s5p-jpeg: prevent buffer overflows [T371989]
  - stable: {CVE-2024-50230} nilfs2: fix kernel bug due to missing clearing of checked flag [T371989]
  - stable: {CVE-2024-40901} scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory [T371989]
  - stable: {CVE-2024-53155} ocfs2: fix uninitialized value in ocfs2_file_read_iter() [T371989]
  - stable: {CVE-2024-26934} USB: core: Fix deadlock in usb_deauthorize_interface() [T371989]
  - stable: {CVE-2024-53156} wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() [T371989]
  - stable: {CVE-2024-56548} hfsplus: don't query the device logical block size multiple times [T371989]
  - stable: {CVE-2023-52840} Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() [T371989]
  - stable: {CVE-2024-46782} ila: call nf_unregister_net_hooks() sooner [T371989]
  - stable: {CVE-2024-44998} atm: idt77252: prevent use after free in dequeue_rx() [T371989]
  - stable: {CVE-2024-26884} bpf: Fix hashtab overflow check on 32-bit arches [T371989]
  - stable: {CVE-2024-53057} net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT [T371989]
  - stable: {CVE-2024-38552} drm/amd/display: Fix potential index out of bounds in color transformation function [T371989]
  - stable: {CVE-2024-46738} VMCI: Fix use-after-free when removing resource in vmci_resource_remove() [T371989]
  - stable: {CVE-2024-38560} scsi: bfa: Ensure the copied buf is NUL terminated [T371989]
  - stable: {CVE-2024-50262} bpf: Fix out-of-bounds write in trie_get_next_key() [T371989]
  - stable: {CVE-2024-53227} scsi: bfa: Fix use-after-free in bfad_im_module_exit() [T371989]
  - stable: {CVE-2024-50267} USB: serial: io_edgeport: fix use after free in debug printk [T371989]
  - stable: {CVE-2024-35847} irqchip/gic-v3-its: Prevent double free on error [T371989]
  - stable: {CVE-2024-50302} HID: core: zero-initialize the report buffer [T371989]
  - stable: {CVE-2024-41087} ata: libata-core: Fix double free on error [T371989]
  - stable: {CVE-2023-52847} media: bttv: fix use after free error due to btv->timeout timer [T371989]
  - stable: {CVE-2024-50279} dm cache: fix out-of-bounds access to the dirty bitset when resizing [T371989]
  - stable: {CVE-2024-53173} NFSv4.0: Fix a use-after-free problem in the asynchronous open() [T371989]
  - stable: {CVE-2024-35821} ubifs: Set page uptodate in the correct place [T371989]
  - stable: {CVE-2024-38627} stm class: Fix a double free in stm_register_device() [T371989]
  - stable: {CVE-2024-27024} net/rds: fix WARNING in rds_conn_connect_if_down [T371989]
  - stable: {CVE-2024-53104} media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format [T371989]
  - stable: {CVE-2024-36886} tipc: fix UAF in error path [T371989]
  - stable: {CVE-2024-50269} usb: musb: sunxi: Fix accessing an released usb phy [T371989]
  - stable: {CVE-2024-56704} 9p/xen: fix release of IRQ [T371989]
  - stable: {CVE-2024-44987} ipv6: prevent UAF in ip6_send_skb() [T371989]
  - stable: {CVE-2024-50301} security/keys: fix slab-out-of-bounds in key_task_permission [T371989]
  - stable: {CVE-2024-46674} usb: dwc3: st: fix probed platform device ref count on probe error path [T371989]
  - stable: {CVE-2024-50264} vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans [T371989]
  - stable: {CVE-2024-53165} sh: intc: Fix use-after-free bug in register_intc_controller() [T371989]
  - stable: {CVE-2023-52922} can: bcm: Fix UAF in bcm_proc_show() [T371989]
  - stable: {CVE-2024-53142} initramfs: avoid filename buffer overrun [T371989]
  - stable: {CVE-2024-53239} ALSA: 6fire: Release resources at card release [T371989]
  - stable: {CVE-2024-46673} scsi: aacraid: Fix double-free on probe failure [T371989]
  - stable: {CVE-2024-42148} bnx2x: Fix multiple UBSAN array-index-out-of-bounds [T371989]
  - stable: {CVE-2024-27043} media: edia: dvbdev: fix a use-after-free [T371989]
  - stable: {CVE-2023-52691} drm/amd/pm: fix a double-free in si_dpm_init [T371989]
  - stable: {CVE-2023-52679} of: Fix double free in of_parse_phandle_with_args_map [T371989]
  - stable: {CVE-2024-38583} nilfs2: fix use-after-free of timer for log writer thread [T371989]
  - stable: {CVE-2024-53141} netfilter: ipset: add missing range check in bitmap_ip_uadt [T371989]
  - uos: net: update Motorcomm Phy driver to 2.2.26536 [G2025012200008]
  - uos: Revert "libbpf: Stop using feature-detection Makefiles" [T351223]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.132.10
changelog:
  - Merge changes from topic "cve-1050a-20250417" into lts-1050u2
  - Merge "uos: update srpm to 4.19.0-91.132.9 [T00000]" into lts-1050u2
  - Merge "uos: update srpm to 4.19.0-91.132.9 [T00000]" into lts-1050u2
  - mainline: {CVE-2024-26974} crypto: qat - resolve race condition during AER recovery
  - mainline: crypto: qat - fix double free during reset
  - mainline: {CVE-2024-38612} ipv6: sr: fix invalid unregister error path
  - mainline: ipv6: sr: fix incorrect unregister order
  - mainline: ipv6: sr: add missing seg6_local_exit
  - mainline: ipv6: sr: fix possible use-after-free and null-ptr-deref
  - mainline: {CVE-2024-50278} dm cache: fix potential out-of-bounds access on the first resume
  - mainline: dm cache: optimize dirty bit checking with find_next_bit when resizing
  - mainline: {CVE-2024-27405} usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - mainline: usb: gadget: f_ncm: Always set current gadget in ncm_bind()
  - mainline: usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  - mainline: usb: gadget: f_ncm: Fix NTP-32 support
  - mainline: usb: gadget: f_ncm: Add OS descriptor support
  - mainline: {CVE-2024-36940} pinctrl: core: delete incorrect free in pinctrl_enable()
  - mainline: {CVE-2024-27395} net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - mainline: net: openvswitch: ovs_ct_exit to be done under ovs_lock
  - mainline: {CVE-2024-35960} net/mlx5: Properly link new fs rules into the tree
  - mainline: hardirq/nmi: Allow nested nmi_enter() [G2025040200015]
  - uos: update srpm to 4.19.0-91.132.9 [T00000]
  - uos: update srpm to 4.19.0-91.132.9 [T00000]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.132.11
changelog:
  - mainline: {CVE-2024-50051} spi: mpc52xx: Add cancel_work_sync before module remove [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: handle isoc Babble and Buffer Overrun events properly [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: process isoc TD properly when there was a transaction error mid TD. [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: store TD status in the td struct instead of passing it along [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: remove extra loop in interrupt context [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: get isochronous ring directly from endpoint structure [G2025060400020]
  - uos: fix "mainline: mptcp: add sk_stop_timer_sync helper"
  - mainline: {CVE-2024-57887} drm: adv7511: Fix use-after-free in adv7533_attach_dsi() [G2025060400020]
  - mainline: {CVE-2024-56659} net: lapb: increase LAPB_HEADER_LEN [G2025060400020]
  - mainline: {CVE-2024-56650} netfilter: x_tables: fix LED ID check in led_tg_check() [G2025060400020]
  - uos: fix kabi broken for struct dst_ops and netns_xfrm
  - mainline: {CVE-2024-36971} net: fix __dst_negative_advice() race [G2025051600022]
  - mainline: mptcp: add sk_stop_timer_sync helper
  - mainline: net: annotate data-races around sk->sk_dst_pending_confirm
  - mainline: af_unix: Fix data race around sk->sk_err.
  - mainline: af_unix: Fix data-races around sk->sk_shutdown.
  - mainline: net: read sk->sk_family once in sk_mc_loop()
  - mainline: sock: Fix misuse of sk_under_memory_pressure()
  - mainline: net: add missing data-race annotation for sk_ll_usec
  - mainline: net: add missing data-race annotations around sk->sk_peek_off
  - mainline: netlink: Add __sock_i_ino() for __netlink_diag_dump().
  - mainline: xfrm: fix a data-race in xfrm_gen_index()
  - Merge changes from topic "xfspatch2" into lts-1050u2
  - Merge changes from topic "cve-a1050u2-20250516" into lts-1050u2
  - mainline: {CVE-2021-47293} net/sched: act_skbmod: Skip non-Ethernet packets
  - mainline: {CVE-2022-49840} bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
  - mainline: {CVE-2022-49842} ASoC: core: Fix use-after-free in snd_soc_exit()
  - mainline: {CVE-2022-49846} udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - mainline: {CVE-2022-49921} net: sched: Fix use after free in red_enqueue()
  - stable: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties [T343551]
  - uos: update srpm to 4.19.0-91.132.10 [T00000]
  - stable: xfs: use iomap_valid method to detect stale cached iomaps [G2025022600028]
  - stable: iomap: write iomap validity checks [G2025022600028]


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.72-79
changelog:
  - Fixed a bug which could result in the UDS index issuing I/O while
    suspended.
  - Resolves: rhbz#1990180


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-83
changelog:
  - Adjusted kernel dependencies to grab the right packages.
  - Resolves: rhbz#2011426
  - Rebuilt for latest kernel.
  - Relates: rhbz#2000909


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Julien Rische <jrische@redhat.com> - 1.18.2-27
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27250
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27244
  - Make TCP waiting time configurable
    Resolves: RHEL-17131


author: Julien Rische <jrische@redhat.com> - 1.18.2-29.01
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45398 RHEL-45386
  - Fix leak of default credentials in gss_inquire_cred()
    Resolves: RHEL-32258


author: José Expósito <jexposit@redhat.com> - 1.7.0-9
changelog:
  - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
  - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
    PutSubImage()
  - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
    a heap overflow


author: Peter Hutterer <peter.hutterer@redhat.com> - 3.5.12-9
changelog:
  - Fix CVE-2022-46285: infinite loop on unclosed comments (#2161800)
  - Fix CVE-2022-44617: runaway loop with width of 0 (#2161808)
  - Fix CVE-2022-4883: compression depends on $PATH (#2160238)


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Daiki Ueno <dueno@redhat.com> - 4.9-1
changelog:
  - Resolves: rhbz#2128672 Rebase libreswan to 4.9
  - Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary


author: Daiki Ueno <dueno@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-23009: remote DoS via crafted TS payload with an
    incorrect selector length (rhbz#2186127)


author: Sahana Prasad <sahana@redhat.com> - 4.9-3
changelog:
  - Fix CVE-2023-30570: Malicious IKEv1 Aggressive Mode packets can crash
    libreswan
  - Resolves: rhbz#2187179


author: maqi <maqi@uniontech.com> - 4.9-3.01
changelog:
  - rebrand: add rebrand-to-uos.patch
  - spec: Set value for DEFAULT_DNSSEC_ROOTKEY_FILE to solve build error


author: Paul Wouters <pwouters@redhat.com> - 4.1-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
  - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch


author: Paul Wouters <pwouters@redhat.com> - 4.2-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
  - Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-7
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76376


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-8
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85887
    Resolves: RHEL-85900
    Resolves: RHEL-85901
    Resolves: RHEL-87039
    Resolves: RHEL-87094
    Resolves: RHEL-87114
    Resolves: RHEL-88348
    Resolves: RHEL-88351


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-9
changelog:
  - Add patches to improve test reliability
  - Backport patches for various CVEs
    Resolves: RHEL-85879
    Resolves: RHEL-92280
    Resolves: RHEL-93031
    Resolves: RHEL-93032


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: Kamil Dudka <kdudka@redhat.com> - 1.2.20-16
changelog:
  - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)
  - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644)


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Matej Mužila <mmuzila@redhat.com> 4.4.0-2
changelog:
  - Update to version 4.4.0
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1354
    CVE-2022-1355


author: mahailiang <mahailiang@uniontech.com> - 2.9.0-9.01
changelog:
  - build: add udisks-mount-patch-changes.patch
  - spec: Modify redhat-rpm-config to uos-rpm-config and /media instead of /run/media


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: zengwei <zengwei1@uniontech.com> - 1.7.0-11.0.1.01
changelog:
  - Add patch to fix integer overflows.
  - Fix compilation by including limits.h
  - Resolves: RHEL-40650
  - fix: fix CVE-2024-5197 CVE-2023-6349


author: Funda Wang <fundawang@yeah.net> - 2.9.10-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 0:1.5.22-2.0.1
changelog:
  - Fix glibc2.32 build issue for better compatible with both glibc2.28 and glibc2.32
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 and gcc8 build


author: Uri Lublin <uril@redhat.com> - 2.4.8-1
changelog:
  - Update to 2.4.8 and pick up CVEs fixes
  - Resolves: rhbz#2050504 CVE-2022-23990
  - Resolves: rhbz#2057023 CVE-2022-25236
  - Resolves: rhbz#2057037 CVE-2022-25235
  - Resolves: rhbz#2057094 CVE-2022-25313
  - Resolves: rhbz#2057099 CVE-2022-25314
  - Resolves: rhbz#2057127 CVE-2022-25315


author: Lubos Uhliarik <luhliari@redhat.com> - 2.9.2-9
changelog:
  - Resolves: #1824859 - RFE: Add a feature that can set a mod_security/libcurl
    timeout for retrieving the rules


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
changelog:
  - FIPS review changes
  -   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  -   update the indicators for this release
  -   allow hashing of longer than int32 values in a single PKCS #11 call.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-5
changelog:
  - Pick up validated constant time implementations of p256, p384, and p521
    from upsream
  - More Fips indicator changes


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
changelog:
  - Fix MD-5 decode issue in pkcs #12
  - turn off policy processing for pkcs12 and smime
  - update the restore defaults for pkcs12


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-6
changelog:
  - fix param encoding in pkcs12 pbamac encoding
  - add support for certificate compression in selfserv and tstclient


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 3.101.0-7.01
changelog:
  - disable unit test
  - cherry-pick `add sw patch #ce8dbcf775a1bf3d6bd0d5de53d3688e7caa00db`. (nijie@wxiat.com)


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.8.2-2.4
changelog:
  - Fix CVE-2019-13224
    Resolves: RHEL-20648
  - Fix CVE-2019-16163
    Resolves: RHEL-20642
  - Fix CVE-2019-19012
    Resolves: RHEL-20636
  - Fix CVE-2019-19203
    Resolves: RHEL-20630
  - Fix CVE-2019-19204
    Resolves: RHEL-20624


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-7
changelog:
  - Fix file caching with different offsets (RHEL-4077)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.13-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Updated pcs-web-ui
  - Updated bundled rubygems: backports, daemons, ethon ffi, json, ruby2_keywords, thin
  - Resolves: rhbz#1730232 rhbz#1786964 rhbz#1791661 rhbz#1791670 rhbz#1874624 rhbz#1909904 rhbz#1950551 rhbz#1954099 rhbz#2019894 rhbz#2023845 rhbz#2059500 rhbz#2064805 rhbz#2068456


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.14-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Updated bundled rubygems: rack
  - Resolves: rhbz#2059500 rhbz#2096787 rhbz#2097383 rhbz#2097391 rhbz#2097392 rhbz#2097393


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.14-2
changelog:
  - Fixed booth ticket mode value case insensitive
  - Fixed booth sync check whether /etc/booth exists
  - Resolves: rhbz#1786964 rhbz#1791670


author: lixin <lixinb@uniontech.com> - 0.10.14-5.03
changelog:
  - cve: CVE-2022-45442 
  - updated bundled rubygems: mustermann, rack, rack_protection, sinatra, tilt
  - added license for rubygem ruby2_keywords
  - build: remove unneeded rubygem webrick
  - build: limit ruby version to 2.5.9
  - arch: remove i686


author: lixin <lixinb@uniontech.com> - 0.10.14-5.03
changelog:
  - cve: CVE-2022-45442 
  - build: remove unneeded rubygem webrick
  - build: limit ruby version to 2.5.9
  - arch: remove i686


author: Peter Jones <pjones@redhat.com> - 0.112-25
changelog:
  - Preserve .py timestamp during install so .pyc/.pyo files have the same
    timestamp on all arches, preventing rpmdiff from complaining.
    Related: rhbz#1625388


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-41
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-43
changelog:
  - Change shouldRollover() methods of logging.handlers to only rollover regular files
  Resolves: rhbz#2009200


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-48.1
changelog:
  - Security fixes for CVE-2020-10735, CVE-2021-28861 and CVE-2022-45061
  Resolves: rhbz#1834423, rhbz#2120642, rhbz#2144072


author: lichao <lichaod@uniontech.com> - 3.6.8-48.1.01
changelog:
  - fix: fix platform dist error
  - spec: change redhat-rpm-config to uos-rpm-config
  - rebrand: add uos platform
  - feat: add sm3 support
  - build: close check on la64
  - fix: testcase fails on loongarch64
  - feat: Add Anolis platform cherry-pick [9a96461]
  - arch: Support Loongarch for python3


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: lichao <lichaod@uniontech.com> - 3.6.8-51.0.1.2
changelog:
  - spec: change redhat-rpm-config to uos-rpm-config
  - rebrand: add uos platform
  - feat: add sm3 support


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  - CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  - Resolves: rhbz#1649153
  - Resolves: rhbz#1700824
  - Resolves: rhbz#1702473
  - Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  - Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  - Resolves: rhbz#1962856


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Philip Kovacs <pkdevel@yahoo.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Added enviromnent module for pmi/pmix
  - Added pkgconfig files for pmix/pmi/pmi2
  - Ensure lexer sources are rebuilt
  - Removed obsolete sasl support
  - Use new ldconfig_scriplets macro


author: Jarod Wilson <jarod@redhat.com> - 2.1.1-2
changelog:
  - Add the --with-tests-examples flag to be able to better verify functionality
  - Related: rhbz#1682374


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-25
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - also when using "-optimizecolorspace" flag
  - Resolves: #1697576


author: Pavel Raiskup <praiskup@redhat.com> - 42.2.0-1
changelog:
  - rebase to the latest upstream release
  - nicer github source urls
  - sync with upstream spec
  - use new postgresql testing macros (rawhide only)
  - depend on postgresql-test-rpm-macros


author: Severin Gehwolf <sgehwolf@redhat.com> - 0.12.0-7
changelog:
  - Add JDK binding sub-packages so that the package
    can be used with either JDK 11 or JDK 17.
  - Add requirement on base package for the JDK binding packages.


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.0.6-8
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Petr Viktorin <pviktori@redhat.com> - 1.0.6-9
changelog:
  - Make python-beaker an optional dependency
  - Add missing python_provide for python3-mako
  - Conditionalize the Python 2 subpackage
  - Modernize the specfile


author: Petr Viktorin <pviktori@redhat.com> - 1.0.6-11
changelog:
  - Add back the Python 2 subpackage (temporarily, for mesa build)
    https://bugzilla.redhat.com/show_bug.cgi?id=1569193


author: Petr Viktorin <pviktori@redhat.com> - 1.0.6-13
changelog:
  - Disable the Python 2 subpackage again
    https://bugzilla.redhat.com/show_bug.cgi?id=1590397
  - Fix the Python2 workaround


author: zhangkea <zhangkea@uniontech.com> - 3.4.0-10.02
changelog:
  - fix cve CVE-2019-19450 
  - Do not evaluate unichar element
  - Replace an invalid char with a correct one (rpminspect)
  - Resolves: RHEL-7008


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Miro Hrončok <mhroncok@redhat.com> - 1.25.7-2
changelog:
  - Subpackage python2-urllib3 has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-14
changelog:
  - Fixes for CVE-2021-25290, CVE-2021-25292, CVE-2021-25293, CVE-2021-27921
  CVE-2021-27922, and CVE-2021-27923
  Resolves: rhbz#1934685 rhbz#1934699 rhbz#1934705 rhbz#1935384 rhbz#1935396 rhbz#1935401


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-15
changelog:
  - Fixes for CVE-2021-25288, CVE-2021-25287, CVE-2021-28675, CVE-2021-28676,
  CVE-2021-28677 and CVE-2021-28678
  Resolves: rhbz#1958231, rhbz#1958226, rhbz#1958240, rhbz#1958252, rhbz#1958257, rhbz#1958263


author: Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042511, rhbz#2042522


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-47
changelog:
  - Filesystem: improve stop-action and allow setting term/kill signals
    and signal_delay for large filesystems

    Resolves: rhbz#2189243


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-51
changelog:
  - aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type parameter
    and AWS Policy based authentication type

    Resolves: RHEL-16248


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-53
changelog:
  - bundled urllib3: fix CVE-2023-45803
  - bundled pycryptodome: fix CVE-2023-52323

    Resolves: RHEL-22431, RHEL-20916


author: lichao <lichaod@uniontech.com> - 4.9.0-54.01
changelog:
  - build: use /usr/bin/ps instead of /bin/ps for 105xe
  - build: disable python bytecompilation for 105xe
  - build: fix httplib2 not found error for 105xe
  - feat: New Resource Agent for TongWeb
  - feat: Resource Agent for solution Two-node cluster brain split
  - fix: iSCSILogicalUnit: fix issue where resource was in stopped state when using allowed_initiators parameter
  - fix: podman: add podman parameter error judgment
  - build: add BuildRequires gettext


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.02
changelog:
  - bundled setuptools: fix CVE-2024-6345
    Resolves: RHEL-50360

  - gcp-pd-move: fix TLS_VERSION_1 issue
    Resolves: RHEL-50041

  - bundled urllib3: fix CVE-2024-37891
    Resolves: RHEL-44923

  - AWS agents: retry failed metadata requests to avoid instantly
    failing when there is a hiccup in the network or metadata service
  - db2: fix OCF_SUCESS typo
    Resolves: RHEL-34137, RHEL-32828


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Abhi Das <adas@redhat.com> - 4.3-21
changelog:
  - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
    CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
    Resolves: rhbz#2007303 rhbz#2000637


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-64
changelog:
  - ci: bump the worker Ubuntu version to Jammy (#2087152)
  - test: make test-execute pass on Linux 5.15 (#2087152)
  - ci: install iputils (#2087152)
  - ci(Mergify): Add `ci-waived` logic (#2087152)
  - sd-event: don't invalidate source type on disconnect (#2115396)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2095744)
  - core: drop references to 'StandardOutputFileToCreate' (#2093479)
  - dbus-execute: fix indentation (#2093479)
  - dbus-execute: generate the correct transient unit setting (#2093479)
  - bus-unit-util: properly accept StandardOutput=append:… settings (#2093479)
  - core: be more careful when inheriting stdout fds to stderr (#2093479)
  - test: add a test for StandardError=file:… (#2093479)
  - tree-wide: allow ASCII fallback for → in logs (#2093479)
  - tree-wide: allow ASCII fallback for … in logs (#2093479)
  - core: allow to set default timeout for devices (#1967245)
  - man: document DefaultDeviceTimeoutSec= (#1967245)
  - Revert "core: Propagate condition failed state to triggering units." (#2114005)
  - core: Check unit start rate limiting earlier (#2114005)
  - core: Add trigger limit for path units (#2114005)
  - meson: add syscall-names-update target (#2040247)
  - syscall-names: add process_madvise which is planned for 5.10 (#2040247)
  - shared: add @known syscall list (#2040247)
  - generate-syscall-list: require python3 (#2040247)
  - shared/seccomp: reduce scope of indexing variables (#2040247)
  - shared/syscall-list: filter out some obviously platform-specific syscalls (#2040247)
  - seccomp: tighten checking of seccomp filter creation (#2040247)
  - shared/seccomp-util: added functionality to make list of filtred syscalls (#2040247)
  - nspawn: return ENOSYS by default, EPERM for "known" calls (#2040247)
  - revert: resolved: pin stream while calling callbacks for it (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-66
changelog:
  - Try stopping MD RAID devices in shutdown too (#1817706)
  - shutdown: get only active md arrays. (#1817706)
  - scope: allow unprivileged delegation on scopes (#2068575)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-67
changelog:
  - resolved: pin stream while calling callbacks for it (#2110549)
  - ci(functions): Add `useradd` and `userdel` (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.1
changelog:
  - time-util: fix buffer-over-run (#2139390)
  - core: move reset_arguments() to the end of main's finish (#2127170)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.4
changelog:
  - basic: add STRERROR() wrapper for strerror_r() (#2155519)
  - coredump: put context array into a struct (#2155519)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155519)


author: lilinjie <lilinjie@uniontech.com> - 239-68.4.01
changelog:
  - fix: KD_FONT_OP_GET failed while trying to get the font metadata: Invalid argument
  - Add: 100002-update-rtc-with-system-clock-when-shutdown.patch
  - Add: 100003-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch
  - fix: add loongarch64 support at systemd-detect-virt
  - spec: remove seccomp support on loongarch64
  - fix: backport from 240 to introdule sd_device_monitor to support UTS01
  - refer to https://github.com/systemd/systemd/commit/b1c097af8df58a94cba031a347061b7cb9b62d9b
             https://github.com/systemd/systemd/releases/tag/v240
  - Add: 110002-systemd-anolis-support-loongarch64.patch
  - build: close check


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: maqi <maqi@unintech.com> - 9:20200406-26.01
changelog:
  - spec: Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - spec: anolis texlive add loongarch64(Yaxuan Liu)


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-10
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154233)
    Resolves: CVE-2022-46340 (bz#2154220)
    Resolves: CVE-2022-46341 (bz#2154223)
    Resolves: CVE-2022-46342 (bz#2154225)
    Resolves: CVE-2022-46343 (bz#2154227)
    Resolves: CVE-2022-46344 (bz#2154229)


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-12
changelog:
  - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
    Resolves: bz#2167058


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-15
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
    Resolves: bz#2180305


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.1
changelog:
  - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
    Resolves: bz#2167057


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.3
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
    Resolves: bz#2180304


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-14
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.1
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15229


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.2
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18421


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.4
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.5
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20432
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20420
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20583
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21252


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.6
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20432


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.7
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20432
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20583


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-7
changelog:
  - Related: #2173874 Tomcat installs older java even though newer java is installed
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-5.1
changelog:
  - Resolves: RHEL-12542 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Update source to include the CVE fixes
  - Update patch command


author: Liu Chao <liuchao173@huawei.com> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)


author: maqi <maqi@uniontech.com> - 2.36.7-1.1.0.2.4
changelog:
  - Add patch: 0001-Resolved-EGL_WAYLAND_BUFFER_WL-undefined.patch
  - Add patch: 0002-mips64-support.patch
  - fix: delete empty link(bugid:123783)


author: maqi <maqi@uniontech.com> - 2.38.5-1.0.1.4
changelog:
  - Add patch: 0001-Resolved-EGL_WAYLAND_BUFFER_WL-undefined.patch
  - fix: delete empty link(bugid:123783)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.0.1.7
changelog:
  - Add patch for CVE-2023-28204
    Resolves: #2209744
  - Add patch for CVE-2023-32373
    Resolves: #2209727


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: songmingliang <songmingliang@uniontech.com> - 1.20.11-15.01
changelog:
  - update: xorg-x11-server-1.20.11-15.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: zhangshaoning <zhangshaoning@uniontech.com> - 1.20.11-17.01
changelog:
  - update: xorg-x11-server-1.20.11-17.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: José Expósito <jexposit@redhat.com> - 1.20.11-20
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18321
    Resolves: https://issues.redhat.com/browse/RHEL-18327


author: José Expósito <jexposit@redhat.com> - 1.20.11-21
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21207
    Resolves: https://issues.redhat.com/browse/RHEL-20528
    Resolves: https://issues.redhat.com/browse/RHEL-20378
    Resolves: https://issues.redhat.com/browse/RHEL-20384
    Resolves: https://issues.redhat.com/browse/RHEL-21191
    Resolves: https://issues.redhat.com/browse/RHEL-21198


author: José Expósito <jexposit@redhat.com> - 1.20.14-23
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: zhangshaoning <zhangshaoning@uniontech.com> - 1.20.11-23.01
changelog:
  - update: xorg-x11-server-1.20.11-23.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038066), CVE-2021-4009 (#2038068),
    CVE-2021-4010 (#2038071), CVE-2021-4011 (#2038073)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-6
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110442, rhbz#2110437


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-8
changelog:
  - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777),
    CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785),
    CVE-2022-46343 (#2151792), CVE-2022-46344 (#2151795)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: wangqia <wangqia@uniontech.com> - 1.2.11-20.01
changelog:
  - fix: add CVE-2018-25032-for-{x86/arm/loongarch}.patches to fix CVE-2018-25032 
  - fix: CVE-2022-37434


